Riot's Vanguard On-Demand lets League and Valorant PCs skip boot start

Riot Games announced on June 24, 2026 that Vanguard, the anti-cheat system behind League of Legends and Valorant, can now run on demand instead of starting with Windows. The new mode is optional and open only to PCs that pass a set of security checks Riot calls Vanguard Pre-Check, according to a post by Phillip Koskinas, who manages the company's competitive integrity portfolio.

Until now, Vanguard's driver, the low-level piece of software that watches the system for cheats, loaded the moment a computer started and stayed active whether or not a Riot game was open. In on-demand mode it launches with the game, runs only while a Riot title is being played, and shuts down when play ends, Riot's support page for the feature says. Players who do nothing keep the behavior they have today. Riot said support begins the day of the post and that the button to switch modes will appear with the next update of the client.

Riot Games figures for League of Legends and Valorant on PC, published June 24, 2026; the hardware share covers weekly players in Riot regions.

What Riot announced on June 24

The announcement changes when Vanguard runs, not what it does. On a PC that qualifies, the driver no longer starts with the operating system. It starts when the player opens a Riot game and stays only for the length of the session. Riot's post applies the mode to League of Legends and Valorant, its two PC titles that use Vanguard, and to Riot's PC titles in general.

Riot was explicit that the option is a choice. Koskinas wrote that Pre-Check is not mandatory but optional, and repeated the point several times in a long post written largely in a joking tone. A player who never touches the new setting sees no change: Vanguard keeps loading at boot, as it has since it was introduced.

The support page, dated June 24 at 11:04 PM, describes the two modes side by side. By default, Vanguard starts automatically with Windows. With Pre-Check satisfied and the option turned on, it launches when a Riot game starts, runs on demand and closes after gameplay. Riot added that it may add further checks to Pre-Check later.

The six settings a PC must pass

Pre-Check is a list of Windows and firmware security features that, together, give Vanguard what it needs without running all the time. Riot's support page lists six of them. Several sit in the PC's firmware setup screen, known as the BIOS or UEFI, which Vanguard cannot change by itself, and some machines may need a firmware update first. Riot said most new machines ship with these settings already on.

A small tray program, VGTray, checks which of the six a given PC is missing. When a device is eligible, it shows the current security status, flags what still needs attention and points the player to Riot's troubleshooting pages and to the documentation of the PC's maker. Riot also set one distinction on the security chip: either a separate TPM or a firmware TPM built into the processor (fTPM) counts for Pre-Check, but an account that Riot has restricted needs an fTPM.

Riot presents the six as layers that each close one route, rather than as a single switch. In its account, Secure Boot stops tampering with Windows while it loads, because a malicious startup loader cannot carry a valid signature without keys only Microsoft holds. VBS, once on, also turns on Microsoft's list of blocked vulnerable drivers. IOMMU makes add-in cards work through translated memory addresses, which lets Riot mark the game's memory as unreadable to them. HVCI checks each page of kernel code before it can run. The TPM ties the result together: it holds the record of which drivers loaded and gives the machine a hardware identity.

Why Vanguard started at boot until now

Vanguard runs at the deepest level of Windows, the kernel, where most software has no access. Riot's reasoning for starting it with the machine was about timing. According to the post, a threat that loads before the game, does its work and removes itself can stay hidden from any tool that only starts later. A driver present from the first second of startup can keep a list of known flawed drivers and act when one appears, so that when the game opens, Riot can treat the system as having stayed clean since boot.

The post argues that this trade-off can now change on machines with modern security features. The reason is a Windows feature Riot credits to Microsoft, the Runtime Driver Attestation report. As Riot describes it, Windows 11 25H2 records every driver that loads into the TPM chip as a running total that can only be added to, never rewritten. An anti-cheat that starts late can then read which drivers were loaded since boot, even though it was not there to see them. Riot said the report holds only driver names and fingerprints and no personal data. With that record and the other five protections switched on, Vanguard no longer needs to be present from startup to know whether the system stayed trustworthy.

How much cheating Riot reports

The post gives a rare set of figures on cheating in Riot's games. According to Riot, about 0.7% of all PC ranked matches across League of Legends and Valorant have a cheater in them today. Ranked is the competitive mode in which players climb a ladder of tiers by winning.

Riot said kernel-level cheats are currently the most common method used against its games, alongside two others it names: cheats that run on separate hardware and read the PC's memory through an add-in card, known as DMA devices, and pixelbots, programs that read the image on screen and move the aim. Cheats running inside the game process, which Riot calls internal cheats, account for under about 10% of infected matches on its PC titles, the post said.

The two games are not exposed in the same way. Riot noted that Valorant already requires Secure Boot for Windows 11 players while League of Legends does not, which leaves League more open to threats that strike before the operating system loads. Valorant relies in addition on behavioral detection, which looks at how a player acts in the game, and Riot said pixelbots can be extremely impactful in Valorant because of its low time-to-kill, the short time it takes to eliminate an opponent. Riot named pixelbots as the next target its integrity team will work on.

What it means for ranked and competitive play

On-demand mode is a convenience for players whose PCs are secured, but Riot tied the wider plan to the competitive ladder. Koskinas wrote that Riot plans to keep Pre-Check optional until players are in the most competitive segments, on the strangest devices, or among the highest ranks. The post did not set a date or a rank at which that would change, and it did not commit to making Pre-Check mandatory for anyone.

On-demand Vanguard changes nothing for players who stay as they are, and Riot keeps it optional below the most competitive segments.

The rules for restricted accounts already point the same way. Riot said accounts it flags for suspicious play, described in the post's joking terms as too botty, cheaty or speedy, can be restricted, and must meet hardware requirements, an fTPM in particular, to keep playing in the competitive ecosystem. The post also describes the TPM chip as a form of hardware identity for the machine.

The announcement concerns the PC client and its ranked queues. It sets no rule for professional leagues or tournaments, and Riot's post does not mention pro play.

How many players can switch now

Riot gave two slightly different figures for readiness, both its own. Early in the post it said about 35% of players already satisfy Pre-Check. Later it put the share of players on fully secured machines at about 34.33%, growing by about 1 to 2% a month. Riot also said only about 3% of weekly players in Riot regions do not have the hardware to support these changes.

The pace Riot set is deliberately slow, and Koskinas summed up the timetable in one sentence: "We're willing to wait until the ecosystem matures."

What comes next

Support for on-demand mode began on June 24, 2026, with the switch arriving in eligible players' clients at their next update. Riot said it may add more checks to Pre-Check over time and that its integrity team's next focus is pixelbots. For the 3% of weekly players without the needed hardware and everyone who prefers the current setup, Vanguard keeps starting with Windows, as before.

The .esports registry publishes Esports Observer, so the whole scene can read its news for free.