What Is Kernel-Level Anti-Cheat and Why Games Require It

Kernel-level anti-cheat is software that runs with the same deep operating-system access as Windows itself, rather than as an ordinary program, so it can watch for cheat tools before they have a chance to hide. It's why big PC shooters like Battlefield 6, Call of Duty, and Valorant now make you enable Secure Boot and install a driver just to click play — and why that requirement has also become one of the most argued-about topics in PC gaming.

What is kernel-level anti-cheat, exactly?

Every program on your PC normally runs in "user mode," a restricted layer of Windows that keeps applications from touching the operating system's core or each other's memory directly. The kernel is the layer below that: it has unrestricted access to hardware, memory, and every running process. Traditional anti-cheat tools, like Valve's Valve Anti-Cheat (VAC), mostly operate in user mode, scanning a game's own process and comparing what they find against a database of known cheat signatures, according to Wikipedia's entry on VAC.

Kernel-level anti-cheat instead installs a signed driver that runs at the same privilege level as Windows itself. From there it can see every driver and process loading on the machine, including ones a user-mode scanner would never notice, and it can block suspicious drivers from loading in the first place. Riot describes its own driver, VGK.sys, as starting with the operating system specifically so it can intercept other drivers before they get a chance to hide, as laid out in Riot's own retrospective on bringing Vanguard to League of Legends.

How the major kernel-level systems compare

Several publishers now run their own kernel driver rather than licensing a shared one, and each behaves a little differently around when it's active and what it protects.

Battlefield 6 and Call of Duty: Black Ops 7, which our comparison of the two shooters covers from a gameplay angle, are the two biggest current examples of publishers betting on their own in-house kernel driver rather than a shared third-party one.

Why studios say they need this level of access

The argument from EA, Riot, and Activision is essentially the same: cheat developers got there first. Modern cheat software increasingly ships as its own kernel-mode driver, which lets it read a game's memory or inject inputs without the game's process ever seeing it happen. A user-mode anti-cheat, by definition, cannot see into the kernel to catch that. EA puts it directly in its own transparency report, arguing that because cheat developers have moved into the kernel, its anti-cheat has to operate there too, according to EA's anti-cheat progress report.

There's also a growing hardware side to this fight: DMA (direct memory access) cheat devices are physical PCIe cards that read a game's memory from outside the operating system entirely, bypassing most software-based detection. Riot's response has been to use a PC security feature called IOMMU to block the memory access those cards rely on once an account is flagged, which is only possible with kernel-level visibility into the hardware.

How anti-cheat ended up in the kernel

Anti-cheat didn't start this invasive. Early systems, including Valve's original VAC, worked by scanning a game's own memory and running processes for signatures matching known cheat programs, then comparing flagged behavior against a database before issuing delayed bans. Valve later added a machine-learning layer, VACNet, and in 2017 introduced an "Overwatch" system that had human reviewers check matches flagged as suspicious. That approach works reasonably well against cheats that also run in user mode, where the anti-cheat and the cheat are on equal footing.

The problem publishers point to is that cheat developers didn't stay in user mode. Once paid cheat services started shipping their own signed or spoofed kernel drivers, loading before the game and anti-cheat even started, a purely user-mode scanner had no way to see them at all. Riot's framing of its own driver, VGK.sys, as something that starts "with the operating system" specifically so it can block other drivers from loading first is a direct response to that shift. It's also why the fight has moved beyond software entirely into hardware: DMA cheat devices read a game's memory from a separate physical card, sidestepping software checks altogether, which is part of why Riot extended enforcement down to the hardware level in 2026, including banning previously flagged devices from a new owner's account the first time they're used to launch a protected game.

Which games require it right now

Kernel-level anti-cheat has gone from a niche requirement to effectively standard for competitive PC shooters:

• Battlefield 6 shipped with EA's Javelin built in at launch, EA's first game to require this level of kernel access from day one.
• Call of Duty: Black Ops 7 and Modern Warfare 4 run Activision's RICOCHET, per the official RICOCHET overview on Activision's support site, which confirms the driver is mandatory on PC with no opt-out.
• Valorant and League of Legends both run Riot Vanguard, which Riot extended from Valorant into League in April 2024 specifically to make bans against scripters, boosters, and other bad actors stick.
• Counter-Strike 2 is the notable holdout: Valve's VAC remains primarily user-mode, with only CS2's Trusted Mode adding a narrower kernel-adjacent anti-tamper check.

Battlefield 6's Steam listing is a useful reference point for how a modern AAA shooter now presents its PC requirements and anti-cheat disclosures up front on the Battlefield 6 Steam store page.

Why it comes with a Secure Boot and TPM checklist

Because a kernel driver has so much power, Windows and the anti-cheat vendors both want proof the system hasn't already been tampered with before that driver loads. That's what Secure Boot and the Trusted Platform Module (TPM) are for: Secure Boot checks that only cryptographically signed, trusted software runs during startup, and a TPM chip can attest that the boot chain wasn't modified. Microsoft frames this as a hardware "root of trust" that security features like System Guard rely on to take boot-time integrity measurements, as described in Microsoft's own documentation on hardware-based root of trust.

In practice, that means Javelin and Vanguard's newer on-demand mode both lean on Secure Boot, TPM 2.0, and related features like virtualization-based security to confirm a clean boot before they'll let a kernel driver run. If you're setting any of this up for the first time, our walkthrough on enabling TPM 2.0 and Secure Boot for Call of Duty and Battlefield 6 covers the BIOS-level steps.

The privacy and security controversy

Kernel-level anti-cheat draws criticism on two separate fronts. The first is privacy: handing any third-party driver the operating system's highest privilege level means, in theory, it could see or do far more than "is this player cheating." Publishers have pushed back directly on this; Riot has stated that Vanguard's driver does not collect or transmit information about your computer, and EA says it worked with outside assessors to confirm Javelin inspects only what it needs to for anti-cheat purposes, per its own progress report.

The second concern is attack surface: a buggy or exploitable kernel driver is a much bigger security risk than a buggy regular app, since a flaw in it could be abused for far more than cheating. Riot has run a public bug bounty of up to $100,000 for researchers who find practical exploits in the Vanguard kernel driver, an acknowledgment of just how high the stakes are if something goes wrong.

A third, more practical complaint is compatibility. Because Secure Boot and kernel-driver requirements generally assume a specific, locked-down Windows environment, most of these systems don't support Linux or Valve's SteamOS, which is why several major kernel-anti-cheat games, Battlefield 6 included, are currently unplayable on Steam Deck.

Does it actually work? The numbers publishers share

Both EA and Riot have published their own figures, which should be read as company-reported data rather than independently audited results. EA says Javelin has blocked more than 33 million cheat attempts across 2.2 billion PC gaming sessions since it launched in 2022, is now active in 14 titles, and claims over 99% accuracy when banning cheaters, per its anti-cheat progress report.

Riot's figures for bringing Vanguard to League of Legends are more granular: more than 175,000 accounts banned for cheating since the rollout, the ranked scripting rate dropping below 1% of games for the first time in nearly four years, daily bot hours falling from over a million to under 5,000, and time-to-ban shrinking from 45-plus games to fewer than 10 — all according to Riot's own Vanguard x League of Legends retrospective. Riot also estimates fewer than 1 in 10,000 bans are false positives.

Is it safe to run, and should you worry?

For most players the practical risk is low: these drivers are signed, published by major studios, and automatically removed when you uninstall the last protected game. The more realistic downsides are compatibility friction (older or dual-boot PCs may need BIOS changes to even launch the game) and the broader principle that you're trusting a third party with kernel access. When Riot enabled IOMMU enforcement against DMA cheat hardware in 2026, panic spread that Vanguard could physically damage a flagged player's PC; Riot said the feature "would not and cannot" brick a machine, though the episode shows how quickly concern escalates once kernel-level software is involved.

If you're deciding whether to enable a game's required anti-cheat driver, the realistic choice is binary: accept it, or don't play that specific game. Every major kernel-anti-cheat publisher now treats it as non-negotiable on PC, with no settings-menu opt-out.

It's also worth separating marketing claims from independently verifiable ones. The ban counts, false-positive rates, and session totals in this piece all come directly from EA's and Riot's own published reports; neither company has released its driver's source code or a fully independent third-party audit for public review, so treat the companies' own effectiveness and safety claims as self-reported rather than externally confirmed. That's also the reasoning behind bug-bounty programs like Riot's $100,000 Vanguard reward: inviting outside researchers to try to break a kernel driver is one of the few ways the public gets any independent signal on how secure it actually is.

What's next for kernel-level anti-cheat

The clearest trend is toward making these drivers less permanently intrusive rather than removing them. Riot's 2026 "On-Demand" option for Vanguard, which loads the kernel driver only while a protected game is actually open instead of at every boot, is the most concrete step any major publisher has taken in that direction, though it currently asks for a stricter hardware checklist (Secure Boot, TPM 2.0, IOMMU, VBS, and HVCI) in exchange. Whether EA's Javelin or Activision's RICOCHET follow with similar always-off-by-default designs, and whether any of these systems ever extend meaningful support to Linux or SteamOS, are the two questions most likely to shape the next round of this debate.

Written byJonah Reyes

Jonah Reyes leads Pandromeda's gaming coverage: console and handheld hardware, release dates, pricing changes, patch notes and the business moves behind the biggest franchises. He sources every date and price from the platform holders and publishers themselves, and says plainly when something is still only a rumour.

More from Jonah ReyesAll Gaming coverage