Riot Games' Vanguard: How Kernel-Level Anti-Cheat Technology is Winning the War Against Video Game Hackers

The battle against video game cheating is an ongoing challenge, and Riot Games, the creators of popular titles like League of Legends and Valorant, is at the forefront of this war. Cheaters have evolved from hobbyists to a sophisticated industry, offering unfair advantages for a fee. In response, Riot has significantly bolstered its anti-cheat team, led by Phillip Koskinas, the director and head of anti-cheat, known for his relentless pursuit of cheaters. Riot's primary tool in this fight is Vanguard, a kernel-level anti-cheat system that provides deep access to a gamer's computer, ensuring that any cheats are immediately visible. Vanguard enforces critical security features in the Windows operating system, such as Trusted Platform Module (TPM) and Secure Boot, which prevent malware and cheats from modifying the system. It also ensures that hardware drivers are up to date and blocks unauthorized code from executing in the kernel's memory. This comprehensive security measures are essential to create a fair playing environment. Koskinas's team employs a multi-faceted approach to combat cheating. They leverage technology, gather intelligence, and use psychological tactics. One of the team's key strategies is reconnaissance, involving the use of undercover identities to infiltrate cheat developer communities. By establishing credibility and gaining access to cheats in development, they can monitor usage and take action once the cheat launches, often by banning all users of the cheat. This not only deters cheaters but also undermines the reputation of cheat developers, making them appear unreliable and foolish. The team also uses hardware fingerprinting to uniquely identify devices used by cheaters, making it difficult for them to return with a new account. Another tactic involves deliberately allowing some cheating to occur to prevent players from constantly switching to undetectable cheats. Koskinas explained, "To keep cheating dumb, we ban slower," ensuring that the majority of cheaters remain inept and easily detectable. Cheaters can generally be categorized into two groups: those using simple, easily detectable "download-a-ban" cheats and those utilizing more advanced "premium" cheats. Premium cheats often involve external hardware, such as direct memory access (DMA) attacks, which use specialized PCI Express cards to exfiltrate game memory to a separate computer. This allows cheaters to see through walls and gain extra-sensory perception (ESP) by identifying players and objects that are not visible to others. More advanced versions use HDMI fusers to overlay the cheat information directly onto the game display, enhancing the cheater's advantage. Screen reader cheats are another form of premium cheat, where the game's HDMI output is sent to a secondary computer for processing. This computer then controls the cheater's mouse, creating an aimbot that can achieve near-perfect accuracy. While these cheats are challenging to detect, they often produce gameplay that looks too precise to be human, making them stand out over time. The future of cheating poses even greater challenges, particularly with the integration of artificial intelligence (AI). AI can classify screen elements and mimic human inputs, making it nearly indistinguishable from legitimate gameplay. However, Koskinas remains vigilant, constantly anticipating and preparing for new cheating methods. Despite the privacy concerns associated with Vanguard's kernel-level access, Riot maintains its commitment to the system for games like Valorant. According to Koskinas, this level of access is necessary to prevent cheaters from exploiting kernel vulnerabilities. The company is striving for transparency, regularly publishing blog posts and engaging with journalists to explain its anti-cheat measures and reassure players about the security and fairness of the game. Riot's efforts have yielded significant results. As of early 2025, fewer than 1% of Valorant's ranked games globally contain cheaters, demonstrating the effectiveness of their comprehensive anti-cheat strategy. Industry insiders commend Riot's proactive and multifaceted approach, noting that it sets a high standard for other game developers. Koskinas's team is seen as a crucial line of defense in maintaining the integrity and competitive spirit of online gaming. Riot Games, founded in 2006, has consistently prioritized player experience and fairness, which has contributed to the long-term success and popularity of their games. Their commitment to transparency and robust anti-cheat measures underscores their dedication to a healthy gaming community.