Riot Vanguard is the custom anti-cheat system built by Riot Games to keep Valorant fair and cheat-free. Unlike older anti-cheat solutions that only run while a game is open, Vanguard operates at the deepest level of Windows — the kernel — and starts automatically every time your PC boots. Understanding how it works helps you make sense of why it behaves the way it does, and what your options are if it ever conflicts with other software.
This guide covers what Riot Vanguard actually is, how its detection layers work, why it loads before Windows finishes booting, how to manage it from the system tray, and how to address common privacy concerns.
Riot Vanguard anti-cheat — five things to know
-
Section 1: What Is Riot Vanguard?
Riot Vanguard is Riot Games' proprietary anti-cheat client for Valorant, introduced when the game launched in 2020. It consists of two main parts: a user-mode client (vgc.exe) that you see in the system tray, and a kernel-mode driver (vgk.sys) that operates with the highest system privileges Windows allows. Vanguard is mandatory — you cannot launch or play Valorant without it running. Its core job is to prevent cheat programs, aimbots, wallhacks, and unauthorized software from affecting your matches.
Vanguard runs as a kernel-level driver and is mandatory for all Valorant PC players. -
Section 2: Why Vanguard Runs at the Kernel Level (Ring 0)
Modern cheat software is sophisticated. Many cheat programs load their own kernel drivers so they can hide from games that only scan at the user level. To beat cheats at their own level, Vanguard runs at Ring 0 — the innermost, most privileged layer of the operating system. At Ring 0, Vanguard can see other drivers as they load, monitor system calls, and block unauthorized code before it ever reaches Valorant. Regular applications, including the game itself, run at Ring 3 (user space), which means Ring 0 gives Vanguard a vantage point that no cheat running at user level can hide from.
Vanguard's driver sits at Ring 0 — the deepest OS layer — giving it visibility over everything that loads beneath Valorant. -
Section 3: How Vanguard Detects Cheats
Vanguard uses several detection methods working in parallel. Driver scanning checks every driver that attempts to load against a blocklist of known cheat-related drivers and refuses them entry. Memory inspection monitors process memory during a Valorant session, looking for code injection techniques that aimbots and wallhacks rely on. Signature and hardware checks compare software signatures and, in some cases, hardware identifiers against a database of flagged cheats — making hardware bans possible even when a cheater reinstalls Windows. When any of these layers detects a violation, Valorant shuts down and the account faces a ban.
Vanguard combines driver scanning, memory inspection, and signature checks to catch cheaters at every layer. -
Section 4: Why Vanguard Starts at Boot
Many cheats are designed to load before a game launches, gaining kernel-level access early so they are already hidden by the time any anti-cheat check runs. Vanguard's boot-time start (vgk.sys loads early in the Windows boot sequence) closes that window. When your PC starts, Vanguard's driver is already watching. By the time you open Valorant, the system has been under observation from the very beginning, so cheats that rely on a head start cannot gain a foothold. The visible result is the Vanguard shield icon in your system tray, which confirms the driver is active and the system is protected.
Vanguard's driver loads during Windows startup — not when you open Valorant — to deny cheats an early-boot advantage. -
Section 5: Managing and Disabling Vanguard
You can disable Riot Vanguard at any time from the system tray icon in the bottom-right corner of your taskbar. Right-click the shield icon and choose Exit Vanguard. This unloads the driver, but a PC restart is required before you can play Valorant again — Vanguard must be running from boot for the game to launch. If a specific driver on your PC (certain RGB lighting controllers, overclocking utilities, or virtual machine tools) conflicts with Vanguard, disabling them or finding an updated version that Vanguard permits is usually the fix. Riot has also added an allowlist for commonly used and verified safe drivers over time.
Right-click the Vanguard tray icon to check status, disable it, or exit — you'll need to restart before rejoining Valorant.
Privacy and security considerations
The most common concern players raise is whether a kernel-level driver represents a security risk. Riot Games states that Vanguard only actively monitors processes and memory while Valorant is running, and that its boot-time driver does not collect or transmit data outside of active gaming sessions. The driver does need to be trusted by Windows, which means it carries a valid Microsoft-approved signature. As with any software at this level, keeping Windows up to date and downloading Valorant only from the official playvalorant.com website eliminates the risk of tampered installers.
Practical tips
- Keep Vanguard updated. Riot pushes Vanguard updates through the Riot Client. Outdated versions can trigger errors on launch — always let the client update before playing.
- Check conflicting drivers first. If Valorant refuses to launch with a "Vanguard not initialized" error, the culprit is often a third-party driver. Open Task Manager, look for software like CPU-Z, EVGA Precision, or HWiNFO, and close them before starting.
- Uninstall cleanly if needed. You can uninstall Vanguard through Windows Settings → Apps. Uninstalling it also stops it from loading at boot, which is useful if you stop playing Valorant entirely.
- Secure Boot matters. Vanguard requires Windows 11 PCs to have Secure Boot and TPM 2.0 enabled. If you see a Secure Boot error, check your BIOS/UEFI settings.
Troubleshooting
Valorant says Vanguard is not initialized
Restart your PC. If the problem persists, open the Riot Client, allow any pending updates to finish, and launch Valorant again. A conflicting driver is the most common cause — close any hardware monitoring or overclocking software first.
Vanguard blocked a driver I need
Right-click the Vanguard tray icon and choose Exit Vanguard, then use the blocked software. To play Valorant again, restart your PC (which reloads Vanguard) and do not launch the conflicting software before your session ends.
How do I completely remove Vanguard?
Go to Windows Settings → Apps → search for "Riot Vanguard" and uninstall it. This removes both the user client and the kernel driver. You will need to reinstall it via the Riot Client before you can play Valorant again.
Frequently asked questions
Does Riot Vanguard run when I'm not playing Valorant?
The kernel driver (vgk.sys) is loaded at boot and stays resident, but Riot states that active data collection and monitoring only occur during Valorant sessions. You can exit the user-mode client from the tray at any time if you prefer not to have it running in the background.
Is Riot Vanguard safe?
Vanguard is digitally signed by Microsoft, meaning Windows trusts it as a verified driver. Riot Games is a well-established company and the software is not considered malware. The main consideration is that it operates at a high privilege level, which is an inherent property of how kernel-level anti-cheat works rather than a flaw specific to Vanguard.
Can Vanguard ban me for software I didn't know was a cheat?
Vanguard specifically targets known cheat software and modified game files. Legitimate third-party apps — even ones that hook into system memory for other reasons — may trigger a conflict but are unlikely to result in a ban unless the software has a history of being used for cheating.
Why does Vanguard need to load at boot rather than when Valorant starts?
Loading at boot lets Vanguard observe the full startup sequence and block cheat drivers before they have a chance to run. If Vanguard only loaded when Valorant launched, a cheat driver that was already active could hide from it or interfere with its initialization.
Does Vanguard work on Mac or consoles?
No. Riot Vanguard is a Windows-only system. Valorant itself is only available on PC (Windows), so there is no Mac or console version of the game or its anti-cheat.
In summary
Riot Vanguard is a serious, kernel-level anti-cheat solution that Riot Games built specifically to tackle the sophisticated cheating ecosystem that competitive shooters attract. Running at Ring 0 from system startup gives it a detection advantage that user-level anti-cheat cannot match. It can be managed from the system tray, disabled when you are not playing, and removed entirely through Windows if needed. For players who want fair matches in Valorant, Vanguard is the engine making that possible behind the scenes.
