Anticheat is winning a war the players are losing

When you install Valorant, a driver is loaded into the Windows kernel before you log in. The driver runs at the highest privilege level the operating system supports. It can read any memory, interact with any device, and stop or modify any process. It does these things, by design, in service of detecting cheating in the game you are about to play.

The driver is called Vanguard. Riot's official documentation explains its architecture in commendable detail. Vanguard is not malware in the strict sense. It is not exfiltrating your data. It is not designed to harm you. But it is, for the purposes of system security, indistinguishable from a piece of malware operating at kernel level, because that is what the category of software is. The trust placed in it is enormous. The reciprocal accountability is small.

Anticheat is not bad. But the cost it asks the player to pay is a serious one, the negotiation was one-sided, and the direction of the technology will soon force a clarification almost nobody is ready for.

What kernel anticheat actually is

In modern operating systems, code runs at one of two privilege levels. User space is where almost everything lives: browsers, games, productivity apps. Kernel space is where the operating system itself runs, plus a small set of drivers for hardware. Kernel-space code can do anything. There is no permission boundary above it. A bug in a kernel driver is a system-wide failure mode.

For most of the history of competitive multiplayer games, anticheat ran in user space alongside the game. Valve's VAC, a long-standing example, still runs this way. The advantage of user-space anticheat is that it cannot break your machine and cannot, by construction, see things outside the game's own process. The disadvantage is that cheats also live in user space and can take measures to hide from anything operating at the same level.

Kernel anticheat solves the cat-and-mouse problem by elevating itself above the cheats. From kernel space it can see process memory, file system access, driver behaviour, and the activity of every running program. Cheats that try to inject into the game are visible. Cheats that try to read game state from outside the process are visible. The detection space expands by orders of magnitude.

Riot's Vanguard, launched in 2020, brought kernel-level anticheat into the mainstream of Western competitive gaming. Easy Anti-Cheat (Epic), BattlEye, Tencent's Anti-Cheat Expert, and Vanguard now collectively cover the majority of competitive multiplayer games on PC. Vanguard runs at boot and stays resident even when the game is not open. EAC and BattlEye typically load when the game launches and unload when it closes, which is a smaller commitment but still a kernel one.

This is not, on its own, a bad architecture. Many drivers run in kernel space and most of them are fine. The question is what tradeoff the player is asked to make in exchange.

The cost, listed

Five real costs the player pays.

A reduction in operating-system security. The attack surface of your machine is the sum of every kernel driver running on it. A bug in any of them is a system-wide bug. Adding a kernel anticheat driver, even a well-engineered one, adds attack surface. The CrowdStrike incident in July 2024, when a defective update to a kernel security product caused millions of Windows machines to refuse to boot, is the canonical demonstration of what happens when this surface fails. The same architectural shape that allowed CrowdStrike to break the world is the architectural shape every kernel anticheat shares.

Loss of platform mobility. Kernel anticheat does not work on Linux, where the kernel is different. Valorant, Fortnite competitive mode, Apex Legends, and most modern competitive multiplayer titles refuse to launch on Steam Deck because of the anticheat layer. ProtonDB tracks the compatibility status of every Steam game on Linux, and the kernel-anticheat titles dominate the "not playable" list. Players who chose Linux for any reason, whether privacy, freedom from Windows, or professional development needs, are excluded from large parts of the competitive multiplayer market.

Always-on resource use. A kernel driver that loads at boot is doing work even when you are not playing the game. Vanguard is the most prominent example of an always-resident anticheat. The CPU and memory overhead is small in absolute terms but real, and it persists across every workload your machine does, not just when the game is running.

An expanded blast radius for vulnerabilities. Any privilege-escalation bug in the anticheat is a remote-code-execution bug at kernel level. The history of widely-deployed kernel drivers is full of these. The bigger the install base, the more attractive the target. Vanguard runs on every active Valorant install, a base Riot reports in the tens of millions of monthly players.

Loss of the ability to inspect what runs on your computer. Most kernel anticheat is closed-source and obfuscated. The player has to trust that the code does what the marketing says it does. The trust is generally well-placed, but the structure does not allow verification, which means it is trust without confirmation. For a piece of software that runs at the highest privilege level on your machine, that is an unusual standard.

What this buys

It is worth being fair to the publisher side. Competitive multiplayer with significant prize pools attracts cheating at industrial scale. Riot has argued that without Vanguard, Valorant would have become unplayable at tournament level within a year. The case for kernel anticheat is real.

What it buys, in measurable terms:

Sharply reduced cheating in the games that deploy it. Vanguard's ban numbers, when Riot publishes them, are large and the publisher reports continued reductions in cheat detection latency.

The ability to ship a competitive multiplayer game at all, in 2026. The publishers that did not commit to a kernel anticheat (EA's Origin team experimented with not requiring one, and walked it back within months) have generally been outcompeted by the publishers that did.

A defense against the long tail of cheat distribution that user-space anticheat cannot match. The cheat market is a real market with real revenue, and the suppliers will allocate their effort against whatever defense the biggest-audience games use.

These benefits are real.

What Microsoft is signaling

In September 2024, following the CrowdStrike incident, Microsoft hosted a Windows security summit and began publicly discussing a long-term move away from third-party kernel drivers in favor of user-space security and anticheat APIs. The Verge's Tom Warren reported on the summit and on the subsequent platform commitments. The timeline is unclear. The direction is not.

If Microsoft follows through, the kernel anticheat era ends within roughly five years. The replacement is a sandboxed API that publishers will integrate into their games, and the operating system itself will provide the detection primitives. The publisher side will lose some detection capability. The operating system will gain accountability. Whether this trade is worth making depends on whether the API is good enough.

For Linux, the same conversation is overdue. The Steam Deck and the broader Linux gaming push have been blocked by kernel anticheat for years, and the response from Valve and others has been informal diplomatic pressure on publishers to either skip kernel anticheat or build Linux support. Some have. Most have not.

The honest forecast

Kernel anticheat will be the default for new competitive multiplayer games released in the next three years. The Microsoft pivot will, in the second half of the decade, push the category toward user-space APIs that publishers will be reluctant to adopt because the migration is expensive and the detection capability is initially lower.

In the meantime, the players who care about kernel-level access to their machines have one choice: either accept the anticheat or skip the games that require it. The first option is what most players will do. The second is a real option. The games that do not require kernel anticheat still exist, are often excellent, and tend to be made by studios that have thought about the question more seriously than the major publishers.

A short list of games we play that do not require kernel anticheat: Counter-Strike 2 (VAC only), Deep Rock Galactic (no anticheat), Helldivers 2 (server-side detection), Marvel Rivals (server-side plus a user-space layer), most of the Larian and Larian-adjacent RPG catalog. There is more to play than the kernel-anticheat list implies.

If you do not want to give a third party kernel access on your machine, you do not have to. The market makes the alternative look smaller than it is. Look harder.