Kernel-level anti-cheat: why games use privileged access

Kernel-level anti-cheat installs a Windows driver with greater privileges than an ordinary application. The decision is not simply a more aggressive way to search for suspicious files. It addresses a hierarchy problem: if a cheat can operate inside the operating system’s core, it may hide processes, alter memory, and intercept answers before a tool confined to user mode receives them.

That access also changes the trust relationship. The privilege that helps an anti-cheat inspect deeper layers increases the possible impact of an error. “Runs in the kernel” is therefore neither proof that a program spies on users nor a guarantee of security. It is an architectural choice that must be assessed alongside startup behavior, data collection, maintenance, and technical limits.

What changes between user mode and kernel mode

Microsoft’s Windows documentation divides execution into two spaces. Applications normally operate in user mode with private memory and isolation: if one fails, the damage usually remains inside that process. Core components and many drivers operate in kernel mode, where they share an address space with the operating system.

This distinction explains both the usefulness and the risk. A kernel driver can see operations that ordinary software cannot reach. At the same time, Microsoft says that writing to the wrong address can compromise data belonging to other drivers or Windows, while a driver crash can bring down the entire operating system.

Cheat developers exploit that asymmetry. Privileged code can interfere with queries from a user-mode anti-cheat and present a false view of the computer. Riot Games and Electronic Arts say their drivers were adopted specifically to confront methods running in the kernel or outside the game process. That rationale is a company statement; it does not mean every project requires the same solution or prove the effectiveness of any particular implementation.

Kernel does not mean “always on”

Two questions are often conflated: what privilege a program has and when it loads. An anti-cheat can use a kernel driver only while a game is open. EA says Javelin runs during protected titles and removes itself after all of those games have been uninstalled.

Vanguard originally took a different approach by loading its driver during startup to check that nothing had compromised the chain of trust before Valorant or League of Legends opened. In June 2026, Riot introduced Vanguard Pre-Check, which enables on-demand operation on computers it considers sufficiently secured.

The optional mode requires at least Windows 11 25H2, UEFI with Secure Boot, TPM 2.0, virtualization-based security, hypervisor-protected code integrity, and IOMMU. At launch, the company estimated that 35 percent of its players already met the requirements. That figure is Riot’s internal estimate, not an independent measurement.

The change illustrates an alternative to continuous monitoring: the operating system and hardware can record evidence about drivers loaded since boot. Anti-cheat can inspect that chain later, reducing the need to remain active from startup. This does not remove its kernel access during play; it only changes when the component runs.

What this protection cannot solve

A privileged driver does not end the contest. Cheats may use direct-memory-access cards, devices that simulate inputs, or software that analyzes only the pixels displayed on screen. Some methods never need to modify the game process. Defense therefore tends to combine several layers.

Authoritative servers reject impossible actions instead of fully trusting a player’s computer. Behavioral systems can identify patterns inconsistent with human play. Local blocking, driver signatures, and frequent updates cover other vectors. Each approach trades visibility, cost, performance, privacy, and the possibility of false positives.

The balanced conclusion is not that every kernel anti-cheat is necessary or abusive. The important point is that it transfers more responsibility to the vendor. Players can check whether the driver starts with Windows, whether it can be disabled or removed, what the data policy says it collects, and how the company handles compatibility problems. Independent audits and a record of prompt fixes provide stronger evidence than generic promises.

Competitive games face real pressure to protect matches, but that does not remove the obligation to minimize privilege and runtime. Vanguard’s shift toward an on-demand option shows how improvements inside Windows can change that balance without eliminating privileged protection altogether.