Vanguard is Riot’s answer to the oldest problem in competitive shooters: someone, somewhere, is cheating in your lobby right now. It’s the most aggressive kernel-level anti-cheat in the business, running before Windows even finishes loading. And yet Valorant cheaters are still out there, still getting kills they shouldn’t, still ruining ranked nights across the UK and everywhere else.
That contradiction is the whole story. Riot built something genuinely invasive, genuinely effective at scale, and genuinely still beatable. Cheat developers haven’t stopped. They’ve just gotten quieter, more hardware-based, and harder to catch on the first pass.
This piece breaks down what Vanguard actually does at the system level, what the ban numbers really show, where cheaters still sneak through, and how Riot’s approach stacks up against EAC, BattlEye, and Ricochet. No fluff, just the mechanics behind one of gaming’s longest-running arms races.
What Vanguard Actually Does at Ring 0
Vanguard isn’t a background scanner that wakes up when you queue. It’s a persistent system that loads a kernel-level driver operating at ring 0, the same privilege tier as Windows itself.
The kernel-level driver explained
Riot built Vanguard as a user-mode service paired with a driver that starts early in the boot sequence, before most third-party software gets a chance to run. That timing matters. Cheat software that loads later has less room to hide.
Always-on anti-cheat vs session-based scans
Older anti-cheat tools scanned inside the game process. Vanguard runs perpetually, inspecting the machine’s trust state even when Valorant isn’t open. It’s an always-on anti-cheat model built to catch cheat hardware and software before a match ever starts, not just during it.
The Ban Numbers: How Many Valorant Cheaters Vanguard Actually Catches
Riot doesn’t hide the scale here, and the numbers are genuinely wild. By September 2024, Vanguard had banned over 3.6 million accounts for cheating since launch, roughly one ban every 37 seconds across four years.
Ban wave frequency and scale
In January 2025, Riot recorded its highest sustained ban velocity yet, almost seven suspensions per minute during a 10 to 13 January stretch. That’s not a one-off ban wave, it’s continuous enforcement running at a pace most anti-cheat systems can’t match.
Cheater prevalence by rank and region
By February 2025, Riot said the global rate of ranked games containing a cheater had dropped back below 1%. Brazil told a different story, briefly hitting 10% of ranked games during that same holiday period. Region matters more than people assume.
How Cheaters Still Slip Past Vanguard
Kernel access sounds unbeatable on paper. It isn’t. The gap between “Vanguard sees everything on the system” and “Vanguard catches every cheat” is where Valorant cheaters keep operating.
DMA cards and firmware-level tricks
DMA cards read memory externally through hardware, sidestepping the protected game PC entirely. Pair that with manipulated DMA firmware or an exploited IOMMU configuration, and there’s no conventional process for Vanguard to flag, because nothing’s actually injecting into Valorant’s memory space from inside Windows.
Aimbot, ESP, and wallhack software that evades detection
Plenty of cheat software still runs through vulnerable or signed drivers that exploit trust Windows already grants. Aimbot and wallhack tools built around randomized testing cycles and constant rebuilds are designed specifically to dodge detection windows rather than brute-force past them. That’s the entire premise behind Valorant cheats with aimbot and ESP built with daily-updated status pages and rapid post-patch rebuilds in mind, engineered to stay ahead of exactly the kind of kernel-level anti-cheat Riot runs. No absolute claims of immunity, just a structural reality: detection is a moving target, not a locked door.
Vanguard vs EAC, BattlEye, and Ricochet: Who’s Actually Winning the Cat and Mouse Game
There’s no official league table ranking these systems by success rate, and anyone claiming otherwise is guessing. What’s public is the philosophy each one runs on.
Detection philosophy compared
Easy Anti-Cheat and BattlEye lean on layered user-mode and kernel-mode detection, details largely proprietary. Ricochet mixes client protections with server-side analytics and its own kernel-level driver in Call of Duty. Vanguard’s boot-time driver approach is the most aggressive of the four.
Which shooters have the worst cheating problems
Comparing raw ban counts across games is misleading. A bigger number might mean more cheating, more enforcement, or just a bigger player base. The cat and mouse game looks different in every title, and competitive integrity gets measured by different yardsticks depending on which publisher you ask.
Reporting a Cheater: What Happens After You Hit “Report”
Hitting report feels like shouting into a void sometimes. It isn’t, but Riot Games keeps the mechanics deliberately opaque.
The in-game report system feeds technical and behavioural data into Vanguard and Riot’s broader enforcement pipeline. Your report doesn’t trigger an instant verdict. It adds a data point.
Decoding the “Cheater Detected” Message
When that message pops up post-match, it means Riot has already tied an account or that match to a confirmed enforcement action. It doesn’t mean your personal report was the deciding piece of evidence. Vanguard’s own detection and other players’ reports often stack together before action lands.
Cheating in Valorant carries a permanent account ban. Knowingly queuing with a cheater, smurfing alongside a known cheat ring member, can get you a 180-day ban too. Harsh, but it’s meant to kill the incentive to squad up with known offenders.
How Long Investigations Actually Take
Riot has never published a guaranteed turnaround time. There’s no public SLA promising action within 24 hours or seven days. Some bans land mid-match. Others surface weeks later, tied to a wider ban wave rather than a single report.
That delay is partly intentional. Rushing detection would mean leaning on surface-level signals instead of deeper behavioural analysis, which only widens the door for cheat developers to slip through.
When Vanguard Flags You Instead of the Cheater
Ironic, isn’t it? The system built to catch Valorant cheaters sometimes blocks legitimate players from launching the game at all.
Driver Conflicts, Boot Failures, and False Positives
Vanguard’s kernel-level driver loads at boot and checks your system’s trust state before Valorant even opens. If it spots an outdated motherboard, storage, RGB, or virtualisation driver it considers unsafe, it can block launch outright.
These aren’t official frequency-ranked issues, just recurring community reports: BIOS settings with Secure Boot or TPM 2.0 disabled, incompatible monitoring software, or a vulnerable signed driver sitting untouched on your system.
A blocked launch doesn’t mean you’ve been accused of cheating. False positives happen because Vanguard treats certain configurations as risk, not because it’s decided you’re running cheat software.
Fixing Vanguard Without Losing Legitimate Access
Riot’s own troubleshooting steps are straightforward: update Windows and device drivers, confirm the BIOS is current, enable Secure Boot and TPM 2.0 where required, and remove known-incompatible low-level utilities. Restarting after any Vanguard update matters more than people assume.
Life on the Receiving End: Smurfs, Toxicity, and Trust Erosion
Getting stomped by a suspiciously good smurf account hits different than losing to a genuine cheater, but the frustration overlaps hard.
Clips and replay systems have become the unofficial second layer of defence legitimate players lean on. A recorded angle, an unnatural flick, a wallhack-style pre-aim through smoke, these clips back up a report when Vanguard’s internal detection hasn’t flagged anything yet.
Trust in ranked keeps eroding regardless. Every Immortal lobby with a suspicious win rate spawns another thread questioning whether Vanguard caught everything or just the clumsy cases. That skepticism isn’t irrational. It’s the natural byproduct of a kernel-level anti-cheat that’s effective but not infallible, running inside a cat and mouse game that never fully resolves.
The Legal Fallout for Cheat Sellers and Buyers
Getting banned is the baseline consequence. It’s not the only one anymore.
A ToS violation inside Valorant stays a civil matter between you and Riot Games, enforced through account and hardware ban tools. Criminal cases are a different tier entirely, usually reserved for the people building and distributing cheat software at scale rather than individual buyers.
The widely discussed Tencent raid against cheat developers signalled that publishers are increasingly willing to pursue legal action against organised cheat rings, not just issue bans. That shift matters because it reframes cheat distribution as a business risk, not just a detection problem for anti-cheat teams to solve alone.
None of this makes third-party tools legal under any game’s terms of service, and nothing here should be read as a workaround to that reality.
Is a Truly Cheater-Free Valorant Even Possible
Probably not. Every kernel-level driver Riot ships gets probed by someone looking for the next gap.
The next front is hardware. TPM 2.0 and Secure Boot already feed Vanguard’s trust checks, and tighter hardware attestation is the logical next step against DMA cards and firmware-level cheat software.
That arms race never really ends. Vanguard raises the floor, cheat developers probe the ceiling, and competitive integrity stays a moving target rather than a finished product.
Login to Geektown