I stopped playing Valorant a while back, but Riot’s Vanguard anti-cheat has been running at boot ever since, whether I play or not. That is finally changing. Riot Games has announced Vanguard On-Demand, an update that stops the Vanguard driver from loading at Windows startup. With Vanguard On-Demand, the anti-cheat runs only when you launch a Riot title like Valorant or League of Legends. Once you close the game, Vanguard shuts down automatically. But there is a catch.
The catch is a security checklist Riot calls Vanguard Pre-Check. To switch to on-demand mode, your PC needs to be running at least Windows 11 25H2 with Secure Boot, TPM 2.0, Virtualization-Based Security, Hypervisor-Protected Code Integrity, and IOMMU all enabled.
What makes On-Demand possible is the work Riot did with Microsoft’s Xbox OS Security Team on a Windows feature called Runtime Driver Attestation Report, which keeps a record of every driver loaded since startup. From there, Vanguard can check at launch whether anything suspicious was loaded while it was inactive.
Riot anti-cheat lead Phillip Koskinas said around 35% of players already meet all the requirements out of the box. Those players will see a toggle appear with their next update. The remaining 65% will need to manually enable the required settings, most of which are BIOS options. Around 3% are on hardware too old to qualify at all.
VIEW GALLERY – 2 IMAGES
Koskinas was clear that Riot is not forcing anyone to change anything, and players who do nothing will have Vanguard continue to run exactly as it does today. On-Demand mode does not change whether you can play Valorant or League of Legends, no matter if you qualify or not.
The always-on behavior has been one of the biggest frustrations with Vanguard since it launched alongside Valorant in 2020. That said, players switching to the On-Demand mode should be aware that VBS and HVCI, two required Windows security features, run parts of the system kernel in a hardware-protected area, and enabling them can cause a small drop in FPS. VBS also activates Microsoft’s vulnerable driver blocklist, which may cause older device drivers to stop working.