Why Fortnite, Call of Duty, Riot and Siege now check Secure Boot and TPM

For most of the history of PC gaming, the settings deep inside a computer were the owner's business. A player installed a game, the anti-cheat came with it, and nobody asked how the machine started up or which security options Windows had switched on. In 2026 that changed across several of the biggest competitive games at once. Before a PC player can enter a Fortnite tournament, a Call of Duty competitive playlist or, once it opens, the top tier of Rainbow Six Siege, the game wants proof that certain protections are active. Riot Games offers League of Legends and Valorant players an optional route built on the same idea.

The names of those protections, Secure Boot, TPM, IOMMU, VBS and HVCI, mean little to most players, and each publisher uses them in its own way. This guide explains what each feature does, as the publishers themselves describe it, why cheat makers have pushed the fight below the level of the game, and how Epic Games, Activision, Riot Games and Ubisoft each turn the features into a rule. It ends with what happens when a PC fails a check and what the checks leave out.

Epic Games, February 10, 2026; Riot Games, June 24, 2026. All three figures are the publishers' own estimates.

Five settings, one chain of trust

The features are not anti-cheat programs. They are parts of the PC and of Windows that make it harder for software to hide, and anti-cheat systems now ask for them because they change what a cheat can get away with. The clearest short description comes from Ubisoft, which presented three of them as layers of one platform in its Rainbow Six Siege Community Checkpoint of August 7, 2026. Epic Games, Activision and Riot Games describe the same features, or the others, in their own posts.

A few terms in the table need a word. Firmware is the low-level software stored on the motherboard that starts the machine before Windows loads, often called the BIOS or UEFI. The kernel is the core of the operating system, where drivers run with the widest access to the machine. VBS stands for Virtualization-Based Security, and HVCI for Hypervisor-Protected Code Integrity; Ubisoft groups the two as one layer under the Windows name Core Isolation. TPM stands for Trusted Platform Module.

The features work as a chain. Secure Boot and VBS make the system harder to tamper with; the TPM is what lets the game trust that they are really active. Ubisoft calls the TPM an enforcement layer that cryptographically confirms the other two are on.

Why cheat makers went below the game

The posts that introduced these rules each name the kind of cheat they target, and the three kinds have one thing in common: they try to start earlier, or sit deeper, than the anti-cheat that watches the game.

The first is the cheat that loads with the system. In February 2025, when Epic Games first required TPM and Secure Boot for some Fortnite tournaments, it wrote that it is common for cheats to behave like bootkits, malicious code that tries to run very early in the system start. Secure Boot answers that by making sure the program that loads Windows comes from a trusted source.

The second is the cheat driver. A driver runs in the kernel, at the same depth as a kernel-level anti-cheat. Riot Games says HVCI checks kernel-mode memory pages cryptographically before they can execute, which blocks unauthorized code such as rogue cheat drivers, and that turning these features on also activates Microsoft's enforcement of its Vulnerable Driver Blocklist, a list of known drivers that Windows refuses to load.

The third is cheat hardware. DMA, for direct memory access, lets a device read a computer's memory directly. Riot describes DMA cards that read memory, often to power wallhacks that show opponents through walls, and calls them one of the world's most expensive hobbies. Krafton, the publisher of PUBG: Battlegrounds, said in its Anti-Cheat 2026 Roadmap of March 24 that it permanently banned about 260,000 DMA-based cheaters in 2025. IOMMU is the answer the publishers point to. Epic Games says the technology lets it better protect game memory from being accessed by cheat hardware; Riot describes it as a firewall between PCIe devices, the cards plugged into the motherboard, and the system memory.

Fortnite: a condition of entry for every tournament

Epic Games made these features a rule for its competitions in two steps. On February 27, 2025, it asked Windows PC players to enable TPM and Secure Boot for tournaments such as the FNCS events that require an Account Level of 350 or higher to enter. Account Level is the experience level a player builds by playing.

A year later, Epic widened it. In a post in its competitive rules library dated February 10, 2026, the publisher said that from February 19 the anti-cheat requirements for PC players would apply to all tournaments, with three features enabled: Secure Boot, TPM and IOMMU. The post defined the new one in a single sentence: "IOMMU is a security feature that helps the operating system control how hardware devices access system memory."

Epic also gave its estimate of the cost to players. About 95% of Fortnite players on PC use a Windows 11-compatible machine, and those players, it said, likely already meet the requirements or can enable them without new hardware.

The post ties the rule to tournaments and places it next to Epic's report on legal action against cheaters, under one anti-cheat announcement.

Call of Duty: proof checked in Microsoft's cloud

Activision's anti-cheat team, Team RICOCHET, uses the same two features as Fortnite's 2025 rule, TPM 2.0 and Secure Boot, but adds a step: it does not trust the PC to report its own settings. Its posts describe Remote Attestation, a check of the PC's security settings carried out on Microsoft's servers through a service called Microsoft Azure Attestation. Local checks, the team wrote on June 4, 2026, can sometimes be manipulated; the remote check validates them on trusted Microsoft servers instead.

The check arrived in two stages in Call of Duty: Black Ops 7. In its Season 02 update of February 2, 2026, Team RICOCHET said a stronger, cloud-based form of attestation would come with Ranked Play, Call of Duty's competitive mode, building on TPM 2.0 and Secure Boot requirements already in place. The check runs before a match begins. The team said that the majority of its players' PCs were already compliant, and pointed to its Secure Attestation Wizard, a tool that helps players confirm their setup.

In its Season 04 update of June 4, the team went further: modern PC security standards are now required to access competitive playlists. Players who fail the Microsoft Azure Attestation check are placed in a separate matchmaking pool and limited to two playlists, Nuketown 24/7 in Black Ops 7 and Battle Royale Casual in Call of Duty: Warzone. They cannot be matched with compliant PC players or with console players, and players in a party with a PC that fails also receive a message that attestation failed. Activision explained the rule in one sentence: "This requirement helps protect the integrity of the game and the experience of the broader community."

Riot: an optional fast lane, for now

Vanguard is Riot Games' kernel-level anti-cheat for League of Legends and Valorant, and its driver normally starts with Windows. On June 24, 2026, it announced Vanguard On-Demand: on PCs that pass a set of checks it calls Vanguard Pre-Check, the Vanguard driver no longer launches when the system starts, but with a Riot game, and runs only while one is played.

Riot's list is the longest of the four: Windows 11 version 25H2 or later, UEFI mode with Secure Boot enabled, TPM 2.0 enabled, VBS and HVCI, and IOMMU enabled, with a BIOS update needed in some cases. The difference from the other publishers is that it is a choice. The post says, in so many words, that Vanguard Pre-Check is not mandatory but optional, and that Riot plans to keep it so until players are in the most competitive segments.

The post also gives the most detailed figures any of the four has published. About 35% of Riot's players already meet Pre-Check, and a later passage puts the share on fully secured machines at about 34.33%, growing by about 1 to 2% a month. About 3% of weekly players in Riot's regions lack the hardware altogether. Riot puts the share of PC ranked matches across League of Legends and Valorant that contain a cheater at about 0.7%, and says internal cheats, the kind that run on the gaming PC itself, make up less than about 10% of the matches with a cheater on its PC titles.

The post also shows how the features serve sanctions. Riot calls the TPM's Endorsement Key, a unique key built into the chip, a non-fungible form of hardware identity: banning it means a cheater would have to physically remove and replace the banned chip. It adds that for the past year it has applied full IOMMU restrictions to high-ranked Valorant cheaters who use DMA.

Rainbow Six Siege: the price of the top ranked tier

Ubisoft ties its rule to a place on the ranked ladder rather than to a mode. On May 17, 2026, it said its Ranked 3.0 update would bring a Legend Division, planned for Season 3, to replace the featured leaderboard at Champion I. To enter it, a player must have reached Platinum or higher in Season 2 and reach Champion in Season 3, and must also enroll in the R6 Shieldguard Secure Platform and set up app-based two-factor authentication.

The Community Checkpoint of August 7 explained the platform. Ubisoft calls it the most significant anti-cheat update the game has had since Rainbow Six Siege launched, and builds it from three features: Secure Boot, VBS and Core Isolation with HVCI, and TPM. Players must enable Core Isolation in Windows Security, and Ubisoft warned that some may need to upgrade their firmware for Secure Boot and TPM to run effectively. The two-step verification uses an authenticator app, is to be extended to other divisions later, and earns an Alpha Pack, an in-game reward.

The same post placed the platform in a wider plan. A model to detect recoil macros, programs that pull the aim down to cancel a weapon's kick, was set to go live on PC later in August, and a system to analyze past matches was in development. Ubisoft Security, a dedicated team, is building a kernel-level anti-cheat to be shared across Ubisoft games, with Siege among the first games to use it.

Four rules side by side

Put together, the four rules use the same building blocks for different purposes. Only Epic Games ties them to tournaments as such; Activision and Ubisoft tie them to ranked play; Riot offers them as an option in exchange for a lighter anti-cheat.

Two lines stand out. Riot's list is the longest, Windows 11 25H2 among it, and it is the only one a player may decline. Activision lists two features but has them validated on Microsoft's servers rather than on the PC itself.

How the rules arrived

The timeline matters because each rule followed earlier steps by the same publisher, and two of them widened a rule that had first applied to a smaller group.

Each rule applies only to its own publisher's games, and one does not carry over to another: a PC that passes Fortnite's check still needs Windows 11 25H2, VBS and HVCI to pass Riot's Pre-Check.

When a PC fails a check

A failed check is not, in the publishers' own words, proof of cheating. Team RICOCHET wrote on June 4 that a PC may fail because of issues with hardware or firmware rather than tampering. It named one case: some AMD TPM software versions in the 3.x.0.x range can cause an error during attestation, fixed by updating the system BIOS or firmware. The team said it works with manufacturers on reported issues, but that the fixes ultimately come from them.

The cost of meeting the rules depends on the machine. Epic expects most of its PC players to need no new hardware, and Activision said the majority of its players' PCs were already compliant. Riot's estimate is that about 3% of weekly players lack the hardware for Pre-Check, and Ubisoft's checkpoint says some Siege players will need a firmware upgrade. Whether a given PC passes depends on its parts, its firmware and its Windows version, and on the list of the game in question. Activision offers its Secure Attestation Wizard to confirm a setup before a match.

What the checks do not cover

The checks concern Windows PCs. Consoles are outside them: in Call of Duty, PC players who fail attestation cannot be matched with console players, and Ubisoft handles console cheating through other systems, such as Mousetrap, which detects mouse-and-keyboard spoofing in controller pools. Activision's and Ubisoft's posts deal with input devices and macros separately from the PC checks.

The checks also concern the player's own PC, at home. At a LAN event, the machine can belong to the organizer. The rulebook of the PUBG: Battlegrounds tournament at the Esports World Cup 2026 in Paris, for example, has the organizer provide the computers and disables internet access on them, and it sets its own rules on mouse drivers and banned tools. Such rules belong to each event and each game.

The new checks do not catch cheaters by themselves. They decide what a cheat must get past before the anti-cheat even starts looking.

Finally, the publishers present the checks as a base for further detection rather than as an end point. Riot says Pre-Check may gain more checks later, Ubisoft is building a shared kernel-level anti-cheat, and Activision keeps the most competitive part of its game for PCs that can prove their settings. Which of these steps reaches which competition, and when, is for each publisher to announce.

The .esports registry publishes Esports Observer, so the whole scene can read its news for free.