Is Kernel-Level Anti-Cheat Safe? The Honest Answer

Published

On this page

Kernel-level anti-cheat is not malware, but it is a genuine trust tradeoff: it runs with the same system privileges as your antivirus software, legitimate publishers use that access to scan for cheat signatures rather than log your general activity, and the real, documented risk isn’t misuse — it’s that a driver with this much access adds attack surface if it’s ever compromised. That’s the honest answer, and it’s worth unpacking both halves rather than picking a side.

Is Kernel-Level Anti-Cheat Safe? The Honest Answer

What “kernel-level” actually means

Windows separates software into privilege tiers. Most applications — your browser, Discord, the game itself — run in user mode, a sandboxed tier where the OS can restrict what they’re allowed to touch. Kernel mode (Ring 0) is the small set of software trusted to interact directly with hardware and the OS core: device drivers, and security software like antivirus and endpoint protection.

Kernel-level anti-cheat — Riot Vanguard, Activision’s Ricochet, and the kernel-mode components of Easy Anti-Cheat and BattlEye — installs a signed driver into that same tier. That’s a meaningfully higher privilege than a normal game needs, and it’s the entire reason the “is this safe” question exists. It’s not a hyperbolic comparison to say this software runs at the same tier as your antivirus, because it genuinely does — that’s the honest scope of the access, not a minimized version of it.

What legitimate publishers do with that access

Publicly documented anti-cheat behavior, per the major vendors’ own disclosures, centers on a narrow set of tasks:

  • Scanning for known cheat signatures in memory and on disk, similar to how antivirus scans for known malware
  • Detecting code injection into the game process — DLL injection, memory writes, hooked functions
  • Checking for tampering with the game’s own files and process
  • Watching for other drivers loading that match known cheat-driver patterns (this is specifically why Vanguard historically ran at boot, not just during a match)

What legitimate anti-cheat does not do, per public documentation and the absence of any confirmed case otherwise: log your general keyboard/mouse activity outside the game, browse your personal files, or transmit unrelated system data. The scope is cheat detection, not general surveillance.

The legitimate criticism, stated plainly

This is where the site’s usual “no overclaiming” rule matters most, because reassurance-only answers on this topic are common and not fully honest. Two criticisms of kernel-level anti-cheat are well-documented and worth taking seriously rather than waving off:

The attack-surface argument. Security researchers have consistently pointed out that any kernel driver — regardless of intent — is a larger attack surface than user-mode software. If a vulnerability is ever found in the driver itself, it could theoretically be exploited by something other than the anti-cheat vendor, at kernel privilege. This is a structural risk of the category, not an accusation against any specific publisher, and it’s the reason security-conscious critics push back on kernel anti-cheat in general, independent of how well any one vendor has behaved so far.

Riot Vanguard’s always-on design drew real, sustained backlash. Vanguard’s driver historically loaded at Windows boot and stayed resident continuously — not just while Valorant was open — specifically to catch cheat drivers loaded outside of a match. When Riot extended this requirement to League of Legends, it produced significant public criticism over the scope of always-on kernel monitoring, and Riot has since adjusted aspects of this behavior in response. That backlash was a legitimate reaction to a genuinely more invasive design choice than EAC, BattlEye, or Ricochet make, all of which only load their kernel component while their own game is actively running.

Ricochet’s kernel scope has drawn similar scrutiny. Security commentary at its 2021 launch specifically flagged the breadth of memory access a kernel-level driver like Ricochet’s is capable of requesting, and separately, some players have reported crashes tied to conflicts between the driver and Windows’ own Memory Integrity / Core Isolation virtualization-based security — a compatibility problem, not evidence of malicious behavior, but a real practical friction point.

Neither Vanguard nor Ricochet has a publicly confirmed case of being exploited by a third party to compromise a player’s system. Riot has run a dedicated bug bounty for Vanguard. That absence of a confirmed breach is meaningful evidence in their favor — but it isn’t the same claim as “kernel-level anti-cheat carries no risk,” and this guide isn’t going to blur that distinction to sound more reassuring.

The reasonable conclusion

For the overwhelming majority of players, kernel-level anti-cheat is safe in the sense that matters day to day: it doesn’t behave like malware, it isn’t documented to overreach its stated purpose, and major publishers have strong business incentive to keep it that way. If you’re deciding whether to install Valorant, League of Legends, or the current Call of Duty, that’s the realistic risk picture.

But “safe for most players” is a judgment call about acceptable risk, not a guarantee. You are trusting a publisher’s security practices and disclosures with kernel-level access to your PC — a level of trust you’d otherwise reserve for your antivirus vendor. If you find that tradeoff unacceptable regardless of any vendor’s track record, declining to install games that require it is a reasonable, informed decision, not an overreaction.

Frequently asked questions

Is kernel-level anti-cheat like a virus or rootkit?

Technically no — a rootkit is malicious software that hides itself and its actions from the user and the OS by design. Kernel-level anti-cheat runs at the same privilege level a rootkit would use, but it's digitally signed, disclosed to you at install, and (for the major vendors) does not attempt to hide its own presence. The 'rootkit' label people use is describing the privilege level, not evidence of malicious behavior — though the criticism that this privilege level is inherently risky if something goes wrong is legitimate and separate from the malware question.

Has Vanguard or Ricochet ever actually caused a security problem?

Riot has publicly stated it runs a bug bounty specifically for Vanguard and has not disclosed a confirmed remote-exploit incident. Ricochet has drawn documented criticism from security researchers over the scope of kernel access it requests, and some players have reported crashes tied to conflicts with Windows' own Memory Integrity / Core Isolation feature — an incompatibility, not an attack. Neither system has a confirmed case of being used to compromise a player's PC through a third party as of this writing; the risk critics raise is the theoretical attack surface a kernel driver adds, not a demonstrated breach.

Does anti-cheat spy on everything I do on my PC?

No, not in the sense of logging your general activity. Anti-cheat kernel drivers scan for known cheat signatures, unauthorized code injection, and tampering with the game process — that's their documented purpose, and it's what publishers state in their anti-cheat privacy disclosures. The legitimate concern isn't 'is it currently misusing this access,' it's that kernel-level access is powerful enough that a compromised update or an undisclosed change *could* do more, and you're trusting the publisher's word and security practices that it won't.

Why does Vanguard run even when I'm not playing Valorant?

Vanguard's driver historically loaded at Windows boot and stayed resident to watch for other drivers loading into your system at any time, not just during a match — this was Riot's most criticized design choice, intended to catch cheat drivers loaded before a game session starts. It is a real difference from EAC, BattlEye, and Ricochet, which only load their kernel component while their respective game is actually running. If you're specifically uncomfortable with always-on kernel monitoring, that's a reasonable line to draw, and it's worth checking the current settings in Vanguard's own client, since Riot has adjusted this behavior in response to player feedback.

Should I be worried about playing games with kernel-level anti-cheat?

For most players, no — major publishers have a strong incentive not to abuse this access, since a confirmed breach would be catastrophic for trust in their game. But 'safe for most players' isn't the same as 'no tradeoff.' You are extending a large publisher a level of system trust normally reserved for your antivirus, based entirely on their disclosures and security practices. If you're not comfortable with that trust relationship, the only fully safe choice is not installing those games — that's a legitimate decision, not paranoia.