League of Legends Vanguard Gets On-Demand Sessions

What Is Riot Games' Vanguard Anti-Cheat On-Demand Mode?

Riot Games' Vanguard is a kernel-mode anti-cheat system originally developed for VALORANT and later integrated into League of Legends. The on-demand session mode, rolled out in early 2025, allows Vanguard to activate only when a player launches a League of Legends game, rather than running continuously from Windows startup. This change addresses long-standing player concerns about system performance, privacy, and security overhead caused by the always-on kernel driver. The feature is available exclusively on PCs that meet Riot's "sufficiently secured" criteria, specifically systems with Secure Boot enabled in the UEFI firmware.

According to the Rock Paper Shotgun report published on February 5, 2025, the update represents a significant policy shift for Riot Games, which had previously maintained that Vanguard's kernel-level persistence at boot was necessary to prevent cheating. The on-demand mode is now available for League of Legends players, with a similar option for VALORANT expected to follow later in 2025.

Key Facts

How Does Vanguard On-Demand Mode Work?

Vanguard on-demand mode loads the kernel-mode anti-cheat driver only when a player launches a League of Legends game session, and unloads it when the game closes. This replaces the previous always-on behavior where Vanguard ran as a kernel driver from Windows boot until shutdown.

The on-demand session requires the player's PC to have Secure Boot enabled in the UEFI firmware settings. Riot Games uses Secure Boot as a trust anchor to verify that the system has not been tampered with before allowing the kernel driver to load on demand. If Secure Boot is disabled, the system falls back to the traditional always-on Vanguard behavior. The Rock Paper Shotgun report notes that this change was driven by player feedback about Vanguard's invasiveness and performance impact on low-end systems.

"Riot is rolling out on-demand sessions for League of Legends' Vanguard anti-cheat, allowing it to run only when you launch a game on PC."

— Rock Paper Shotgun, February 5, 2025

Riot Games' Vanguard on-demand mode for League of Legends activates the kernel driver exclusively during game sessions and requires Secure Boot to be enabled on the player's PC.

Why Did Riot Games Change Vanguard From Always-On to On-Demand?

Riot Games changed Vanguard from an always-on kernel driver to an on-demand session mode to address player complaints about system performance, privacy concerns, and the perceived invasiveness of a kernel-level process running continuously at Windows startup. The change was announced in early February 2025.

Since Vanguard's introduction with VALORANT in 2020, players had criticized the anti-cheat for its kernel-mode driver that loaded at boot and remained active regardless of whether the game was running. This design caused compatibility issues with certain hardware drivers, reduced system performance on lower-end PCs, and raised security concerns about a third-party kernel driver with persistent system access. Riot Games had previously defended the always-on approach as necessary for effective cheat detection, but the new on-demand mode represents a compromise that maintains security while reducing the system footprint. The Rock Paper Shotgun article states that the on-demand mode is "for sufficiently secured PCs," indicating that Riot has developed a trust verification mechanism using Secure Boot to ensure the system integrity before allowing on-demand kernel loading.

Riot Games transitioned Vanguard to on-demand sessions after years of player criticism about the always-on kernel driver's performance impact and privacy implications, with the change rolling out in February 2025.

What Are the System Requirements for Vanguard On-Demand Mode?

Vanguard on-demand mode requires a PC with Secure Boot enabled in the UEFI firmware settings. Systems that do not meet this requirement will continue using the traditional always-on Vanguard behavior. No other hardware or software changes are needed beyond enabling Secure Boot.

Secure Boot is a UEFI security standard that verifies the digital signature of bootloaders and kernel drivers before allowing them to execute. By requiring Secure Boot, Riot Games ensures that the system has not been compromised by rootkits or bootkits that could bypass the on-demand kernel driver loading mechanism. The Rock Paper Shotgun report does not specify whether additional TPM (Trusted Platform Module) requirements exist, but Secure Boot is the primary criterion mentioned. Players with older motherboards or systems where Secure Boot is disabled in the firmware settings will not be able to use the on-demand mode and will default to the always-on Vanguard driver.

Vanguard on-demand mode requires Secure Boot enabled in UEFI firmware, and systems without Secure Boot will continue using the always-on kernel driver.

Who Is Vanguard On-Demand Mode For?

Vanguard on-demand mode is designed for League of Legends players who want to reduce the system footprint of the anti-cheat software, particularly those who use their PC for non-gaming tasks and prefer not to have a kernel-mode driver running continuously. The feature targets players with Secure Boot-capable systems who prioritize performance and privacy.

The on-demand mode is especially relevant for:

• Players using lower-specification PCs where Vanguard's always-on kernel driver measurably impacts system performance during non-gaming use.
• Users concerned about the security implications of a third-party kernel driver with persistent system access.
• Players who play League of Legends intermittently and do not want the anti-cheat running during work, browsing, or other non-gaming activities.
• System administrators and power users who prefer granular control over which kernel drivers are loaded on their systems.

The feature is not available for players whose systems lack Secure Boot support or have it disabled, as Riot Games requires this security baseline to trust the on-demand kernel loading mechanism.

Vanguard on-demand mode is intended for League of Legends players with Secure Boot-enabled PCs who want to eliminate the always-on kernel driver's performance and privacy overhead.

Common Questions

Does Vanguard on-demand mode work for VALORANT?

As of February 2025, Vanguard on-demand mode is available only for League of Legends. Riot Games has indicated that a similar on-demand option for VALORANT is expected to roll out later in 2025, according to the Rock Paper Shotgun report.

What happens if my PC does not have Secure Boot enabled?

If Secure Boot is disabled on your system, Vanguard will continue to run in its traditional always-on mode, loading at Windows startup and remaining active continuously. You must enable Secure Boot in your UEFI firmware settings to use the on-demand session feature.

Will Vanguard on-demand mode reduce cheating in League of Legends?

Riot Games has not stated that on-demand mode changes the anti-cheat's detection effectiveness. The kernel driver still loads during game sessions with the same capabilities. The change primarily affects when the driver runs, not how it detects cheats. The Rock Paper Shotgun article does not provide data on cheating rates.

Sources and Methodology

This article is based on a single primary source: the Rock Paper Shotgun article titled "League of Legends Vanguard anti-cheat finally gets the option to only run when you fire up a game as Riot roll out on-demand sessions for sufficiently secured PCs," published on February 5, 2025, and authored by the Rock Paper Shotgun staff. The article was accessed at https://www.rockpapershotgun.com/league-of-legends-vanguard-anti-cheat-finally-gets-the-option-to-only-run-when-you-fire-up-a-game-as-riot-roll-out-on-demand-sessions-for-sufficiently-secured-pcs. No additional sources, external studies, or datasets were referenced in the source material. All technical descriptions of Vanguard's kernel-mode operation and Secure Boot requirements are derived from the Rock Paper Shotgun report and general knowledge of anti-cheat software architecture. This article was last updated on February 6, 2025.