Riot Games announced on June 28 that Vanguard, the kernel-level anti-cheat system powering League of Legends, VALORANT, and 2XKO, will gain an optional On-Demand mode. The change lets eligible players run the Vanguard driver only while a Riot title is open, rather than loading it at system startup. Riot Games said in its announcement that the feature is entirely voluntary and that no player is required to switch.
Since Vanguard launched alongside VALORANT in 2020 and later expanded to League of Legends, the driver has loaded at boot and remained resident in memory for the entire session. That design gave Riot’s anti-cheat team early access to detect tampering before a game client even launches, but it also drew persistent criticism from players who objected to a kernel driver running continuously on their machines. Vanguard On-Demand is Riot’s answer to that friction: the same driver, the same protections while a game is running, but no presence on the desktop once the game closes.
How Vanguard On-Demand Works
The new mode is gated behind a verification step Riot calls Vanguard Pre-Check. Pre-Check assesses whether a given system meets a set of hardware and security requirements that Riot says are necessary to maintain anti-cheat integrity without the always-on driver. Riot stated that approximately 35 percent of players already satisfy those requirements and can enable On-Demand mode as soon as the next Vanguard update reaches their client.
For players who pass Pre-Check and opt in, the behavioural change is straightforward. The Vanguard driver launches when a Riot game starts and unloads when the game closes. The VGTray system tray icon, which has been a constant presence on the desktop since Vanguard’s introduction, disappears unless a Riot title is actively running. Outside of a game session, the system behaves as though Vanguard is not installed.
Players who do not pass Pre-Check, or who simply prefer the current setup, change nothing. Vanguard continues to load at boot and run in the background exactly as it does today. Riot was explicit on this point: “This is all 100% optional, and you only need to do anything if you’d like to enable on-demand mode, which will allow Vanguard to launch when the game does and remain running only while you’re playing a Riot title.”
Trust Segmentation and the Road Ahead
Riot framed Vanguard On-Demand as part of a broader strategy it calls trust segmentation. The idea is to calibrate how much the anti-cheat system demands from a player based on how much risk that player’s environment represents. A casual player on a well-configured desktop PC poses a different threat profile than a high-ranked competitor on an unusual hardware setup, and Riot intends to treat those cases differently.
In a statement carried by GosuGamers, Riot said: “Ultimately, for competitive online spaces to persevere, it is necessary that we be able to trust the endpoints that the games are played on. For that reason, our trust segmentation will be surgical, and while we might add more checks to Pre-Check in the future, we plan on keeping things optional until you’re in the most competitive segments, on the strangest devices, or amongst the highest ranks.”
That last clause is worth parsing. Riot is signalling that On-Demand mode may not remain optional indefinitely for everyone. Players at the top of ranked ladders, or those using hardware configurations that are harder to verify, could eventually face mandatory Pre-Check requirements or be required to keep the always-on driver active. For now, though, the company is keeping the door open. “We’re not making anyone change anything,” Riot said. “We’re willing to wait until the ecosystem matures.”
The mention of ecosystem maturity likely refers to the broader hardware and OS landscape. Security features like TPM 2.0, Hypervisor-Protected Code Integrity, and Virtualization-Based Security have become more widely available in recent years but are not yet universal, particularly on older machines or in regions where legacy hardware remains common. Riot appears to be betting that adoption of these technologies will continue to rise, making Pre-Check passable for a larger share of the player base over time.
What This Means for Anti-Cheat in Competitive Play
Vanguard has been one of the more effective kernel-level anti-cheat systems in live service, and its always-on architecture is a significant reason why. By loading at boot, Vanguard can detect certain classes of cheat software—particularly those that hook into the kernel early in the startup sequence—before a game client ever launches. Removing that boot-time window, even optionally, narrows the detection surface.
Riot’s trust segmentation model is designed to compensate. Players who pass Pre-Check are, by definition, running hardware and OS configurations that Riot considers verifiable through other means. The company is effectively trading a small reduction in detection coverage for those users against a meaningful improvement in player goodwill and system transparency. For the highest-stakes competitive environments, Riot retains the option of requiring the full always-on driver, preserving its strongest detection posture where cheating incentives are greatest.
It is a calculated trade-off, and one that Riot has clearly signalled is reversible. If On-Demand mode leads to a measurable increase in cheating among eligible players, the company can tighten Pre-Check requirements or revert specific segments to always-on enforcement. The language in the announcement leaves that flexibility intact.
For Players
If you play League of Legends, VALORANT, or 2XKO and want to try On-Demand mode, the first step is to wait for the next Vanguard update. Once it arrives, players whose systems pass Pre-Check will see an option to switch. There is no manual sign-up or application process; eligibility is determined automatically.
If the option does not appear, your system does not currently meet Pre-Check requirements. No action is needed, and your anti-cheat protection remains unchanged. Vanguard will continue to load at boot and run in the background as before.
If you do switch, the practical difference is simple: Vanguard’s tray icon vanishes when no Riot game is running, and the driver is not resident in memory outside of game sessions. The moment you launch a Riot title, the driver loads and provides the same protections it always has. When you close the game, the driver unloads.
Nothing about your ranked standing, matchmaking, or account status changes regardless of which mode you use. Riot has not indicated any gameplay or competitive difference between always-on and On-Demand configurations.