Vanguard Anti-Cheat Explained: Boot, BYOVD, VAN Errors

What Vanguard actually is

Vanguard is Riot Games' anti-cheat system. It ships with Valorant, with League of Legends as of early 2024, and with every Riot title launched after that point. On paper it sits in the same category as BattlEye and Easy Anti-Cheat. In practice, it operates at a deeper privilege level than any of them, and the way it gets there is the entire story.

Most anti-cheats load when you launch the game. Vanguard loads when you turn on your computer. That single design choice, taken in 2020 and never softened since, is why the cheat market treats Valorant differently from every other competitive title. Kernel drivers running for hours before any game process exists have fundamentally different visibility than drivers that load alongside the game.

This is also why the system collects so much controversy. Vanguard wants Secure Boot enabled. It wants TPM 2.0 on. It wants UEFI mode, not legacy BIOS. On Windows 11 it refuses to run if any of those are missing. The trade-off is plain. Riot accepts smaller potential audience in exchange for a hardware-rooted trust chain that begins before any cheat driver has the chance to start.

Boot-time loading: why it starts before Windows

The Vanguard driver, named vgk.sys, is registered as a Windows boot-start driver. That places it in the same load category as the disk driver and the keyboard driver. The kernel loads it before user-mode services come up, before the network stack initializes, before any third-party software gets a chance to execute a single instruction.

The practical consequence is simple. By the time any cheat process could exist on the system, Vanguard has already been watching for hours. Anything that loaded after Vanguard had to pass through filters Vanguard installed. Anything that wants to load a kernel driver after Vanguard is running has to do it with the operating system functioning normally, which means going through the standard driver loader, which means signing, which means certificate scrutiny.

This is the cheat market's actual problem with boot-time anti-cheats. A driver loading at boot-time has no peer drivers above it to interfere with its hooks. A driver loading after boot, on a system that already has Vanguard running, walks into a room where every camera has been on since the lights came up. For the firmware-side context on why the pre-Windows boot window matters, see the UEFI pre-boot gap article.

Vanguard idles when no Riot game is running. It still occupies kernel memory, still maintains its event handlers, still logs system anomalies to its database. The game launcher does not bring it up; it brings up the user-mode component that talks to the already-resident driver. That is why Riot tells players to reboot after installation, not just restart the launcher.

The driver allowlist and BYOVD defense

BYOVD stands for Bring Your Own Vulnerable Driver. It is the attack pattern that defined kernel cheats from 2019 through 2023. The cheat developer does not need to publish a signed driver themselves. They find a legitimate signed driver with an exploitable bug, load it through the normal Windows driver loader, then use the bug to execute their own unsigned code in kernel mode. The signature requirement is satisfied by the legitimate driver. The kernel access is provided by the bug.

Microsoft maintains a list of known-bad drivers in a system file called the Microsoft Vulnerable Driver Blocklist. Vanguard maintains its own. Riot's list is broader, updated faster, and applied at boot-start where Windows cannot be told to ignore it. When a player tries to load one of these drivers, the kernel refuses, and Vanguard logs the attempt.

The list is not static. Riot pushes new entries through the Vanguard update channel, which runs independently of the game client and arrives without a restart in many cases. When a new BYOVD technique surfaces in cheat forums, the driver tends to appear on the blocklist within days, sometimes hours.

Vanguard also walks two specific kernel structures that Windows itself maintains, called PiDDBCacheTable and MmUnloadedDrivers. These tables record every driver that has ever been loaded on the current Windows session, even after it has been unloaded. A cheat developer who loads a vulnerable driver, exploits it, and unloads it cleanly still leaves a trace in those tables. Vanguard reads the trace.

How Vanguard watches a running PC

Once the system is up and Vanguard is resident, the driver does several things that conventional anti-cheats do not.

It hooks system service calls at the kernel level, which lets it observe every process creation, every driver load, every privileged operation attempted by user-mode software. It walks the loaded module list periodically and compares hashes against known cheat signatures. It monitors handle creation against the game process, so any third-party tool opening OpenProcess against Valorant logs an event whether the tool ever reads memory or not. It samples physical memory regions for known cheat patterns at intervals the cheat cannot predict.

The right-hand column is the part cheat developers find difficult. In the standard model, anything that loads in those first 45 seconds gets to do its work before any anti-cheat exists. In the Vanguard model, those 45 seconds are observed by the same driver that will be observing the cheat when the player presses Play.

Beyond watching, Vanguard also acts. The driver can refuse to let the game start if it detects that another module has tried to tamper with its own memory. It can halt the system if it spots a kernel-mode hook on one of the syscalls it cares about. It can refuse to load entirely if Secure Boot is off and the player is on Windows 11. Each of these is a hard stop, not a flag.

The VAN:Restriction error wall

The VAN: error series is the player-facing layer of all this enforcement. Each code corresponds to a specific check that failed. Most players who hit one of these have never installed a cheat. They installed a development tool, ran a hardware diagnostic, or updated a kernel-mode antivirus that Vanguard does not yet recognize.

The serious code in that list is VAN:9001. Riot uses that one when the driver has decided that the system state is suspicious enough to warrant blocking the player from connecting, but not suspicious enough to justify a permanent ban without human review. Accounts in this state usually clear within a few days if the player removes the offending software and reboots. They do not always clear.

VAN:6 is the one cheat buyers care about. It is the hardware ban. When Vanguard records this code, it has matched the player's TPM EkPub against an entry on the ban list, and no amount of reinstalling Windows, swapping drives, or HWID spoofing at the storage layer will move it. The only paths off VAN:6 are physical hardware replacement or a successful appeal to Riot, which is rare.

Vanguard against BattlEye, EAC, and EA AntiCheat

Putting Vanguard next to its peers makes the design philosophy clearer. BattlEye loads when the game starts. EAC the same. Both rely on Microsoft's blocklist plus their own additions, applied at runtime instead of boot-start. Both can be defeated by a kernel driver that loads before they do, if the cheat developer can get one past the standard driver loader.

The contrast with sports titles is the sharpest of all. EA's anti-cheat for EA FC 26 and the modern Battlefield series, called EA AntiCheat, is also a kernel module. But it does not run at boot-start, does not enforce Secure Boot, and does not maintain anything like Vanguard's allowlist for vulnerable drivers. The threat model is different. A football game does not face the same volume of well-funded internal cheats that a tactical FPS does, so the security ceiling is set accordingly. EA AntiCheat is a real kernel anti-cheat; Vanguard is a kernel anti-cheat plus a paranoid systems-administrator policy.

BattlEye in Escape from Tarkov sits somewhere in the middle. It is a mature kernel driver with strong behavioural telemetry, but it does not control the boot environment. Tarkov cheats face memory scans, signature checks, and HID device analysis, all serious, but the room to maneuver in the first 45 seconds of a Windows session is still wide open. Same picture in PUBG, where BattlEye runs alongside an additional layer added by Krafton's own anti-cheat tooling, with the same boot-start gap.

This is why cheat pricing on Valorant runs visibly higher than on Tarkov or PUBG despite Valorant being a simpler game to detect targets in. The detection ceiling on Vanguard is higher, the development cost per build is higher, and the burn rate when a build is patched is higher. ZhexCheats prices Valorant access the way it does because the engineering work behind each Valorant build is genuinely different from the work behind a Tarkov build.

What this means for cheat development in 2026

The state of play with Vanguard going into 2026 is that the conventional kernel cheat is essentially over. Loading a custom driver into a system Vanguard is already watching, without triggering at least one of the boot-time, blocklist, or tampering checks, requires exploits at a level that does not survive a single patch cycle. The kernel route is not closed in theory. It is closed in economics. A working bypass costs more to develop than a vendor can recover before Riot patches it.

What remains is hardware. DMA cards, capture-card-plus-AI setups, and KMbox-style input emulators all sidestep Vanguard by never running code on the game PC in the first place. Riot acknowledges the category openly in their security blog posts and explicitly treats it as an industry-wide problem they cannot solve alone, because the cheat is not on the machine they are watching.

The other path is account-side, not machine-side. Stat manipulation, ELO routing, and account boosting all live outside Vanguard's threat model because the player using them is genuinely a human pressing genuine buttons; the abuse is on the matchmaking side, and the kernel cannot see it. That is why services like Valorant rank boosting still exist in volume despite Vanguard, and why Riot has invested heavily in server-side analytics to catch the things their client-side driver cannot.

For a player choosing between cheats in 2026, the practical reading is that Valorant requires a different mental model than other FPS games. Cheap public cheats do not survive. Mid-tier internal cheats do not survive long either. The categories that work are hardware setups, properly maintained DMA builds, and a small set of private internals with serious anti-cheat engineering behind them. ZhexCheats stocks the categories that actually still function against Vanguard, and the price reflects what staying ahead of vgk.sys actually costs.

Read the build's last patch date and ban history before anything else. With Vanguard, those two numbers tell you more than any feature list.