Why Does Anti-Cheat Need Secure Boot and TPM 2.0?

Published

On this page

Kernel-level anti-cheat like Riot Vanguard and Activision’s Ricochet requires Secure Boot and TPM 2.0 because it needs proof that nothing tampered with your PC’s boot process before its own driver loaded — without that proof, a compromised boot chain could hide a cheat from the anti-cheat itself. This is a real, deliberate requirement, not a bug or an overzealous default. Here’s what each piece actually does and why the anti-cheat cares.

Why Does Anti-Cheat Need Secure Boot and TPM 2.0?

The problem kernel-level anti-cheat is solving

Anti-cheat systems that operate at the kernel level — the same privilege tier as your antivirus and core Windows drivers — are in an arms race with cheats that also try to run at that level. A cheat running in the kernel can hide itself from a user-mode scanner entirely, which is why Vanguard, Ricochet, and the kernel components of EAC and BattlEye all load their own driver early and with high trust.

But that creates an obvious problem: if a cheat can load before the anti-cheat driver does, or load a malicious driver during boot, it can potentially blind the anti-cheat before it ever gets a chance to look. The anti-cheat needs a way to know the boot process itself wasn’t tampered with. That’s exactly what Secure Boot and TPM 2.0 provide together.

What each one actually does

TPM 2.0 (Trusted Platform Module) is a small, isolated hardware component — either a physical chip or, far more commonly today, a firmware feature built into your CPU (AMD’s fTPM, Intel’s PTT) — that stores cryptographic keys in a way the rest of the system can’t tamper with. It’s the hardware root of trust: a place to anchor “this key is genuine” that nothing running on the OS itself can fake or extract.

Secure Boot is the process that uses those keys. During startup, UEFI firmware checks the digital signature of each component in the boot chain — the bootloader, the Windows kernel, early drivers — against the trusted keys, refusing to run anything unsigned or altered. It’s verifying, link by link, that nothing swapped in a malicious version of any file the OS depends on before Windows was even fully running.

Put together: TPM proves the keys are genuine, Secure Boot uses those keys to verify the boot chain. By the time Windows finishes loading, both give a mathematical guarantee (not just an assumption) that the path from power-on to your desktop wasn’t altered.

Why this specifically matters to anti-cheat

A kernel-level anti-cheat driver has to trust the environment it’s loading into. If Secure Boot is off, it’s possible for a bootkit or a malicious driver to load earlier in the chain than the anti-cheat can inspect, potentially with the ability to hide processes, files, or other drivers from everything that loads afterward — including the anti-cheat. That’s the exact scenario kernel-level cheats have historically tried to exploit: get privileged access before the thing that’s supposed to catch you does.

Rather than try to detect that after the fact, publishers like Riot and Activision simply refuse to load their driver unless the boot chain’s integrity can be verified up front. It’s a precondition, not a runtime check — which is why the error you get isn’t “cheat detected,” it’s “can’t start.”

How to enable them

Both settings live in your motherboard’s BIOS/UEFI firmware, not in Windows. The exact menu differs by brand:

On most boards built in the last several years, both are firmware toggles rather than missing hardware — TPM is built into the chipset (fTPM/PTT) and just needs switching on, and Secure Boot needs your Windows install to already be UEFI/GPT rather than legacy MBR. Each guide above covers verifying that before you flip anything.

Frequently asked questions

Why does Valorant require Secure Boot and TPM?

Riot Vanguard loads a kernel-level driver, and before it will load, it needs proof that nothing tampered with the boot process ahead of it. Secure Boot provides that proof by verifying every boot component against a chain of trust rooted in your TPM's hardware keys. Without both, a compromised boot chain could theoretically hide a cheat driver from Vanguard itself, so Riot refuses to launch rather than run with an unverifiable boot state.

Do all anti-cheat systems require Secure Boot and TPM?

No. Riot Vanguard and Activision's Ricochet enforce both as hard requirements. Easy Anti-Cheat and BattlEye can be configured to require them per publisher, but don't universally enforce it across every game that uses them. VAC (CS2) doesn't require either.

Is it safe to enable Secure Boot and TPM just to play a game?

Yes. Both are standard Windows 11 security features, not anti-cheat-specific settings, and Microsoft has required TPM 2.0 for Windows 11 since launch. Enabling them doesn't touch your files or installed software. The only real precaution is confirming your Windows drive is formatted as GPT (not the older MBR) before flipping Secure Boot on, since Secure Boot requires a UEFI/GPT setup.

My motherboard has TPM but it's disabled by default. Why?

Most desktop motherboards ship with firmware TPM (fTPM on AMD, PTT on Intel) built into the chipset but turned off in BIOS by default, since many buyers never install Windows 11 or play anti-cheat-gated games. It's a firmware toggle, not a missing part — there's no physical chip to buy on any board from the last several years.

Will enabling Secure Boot break my other software or dual-boot setup?

It can affect dual-boot Linux setups, since some Linux distributions need Secure Boot disabled or their own signed bootloader to start correctly — check your distribution's Secure Boot support before enabling it. For a standard single-OS Windows 11 PC, enabling Secure Boot has no effect on other installed software.