Riot Vanguard

All of the following is Riot's own public description of Vanguard.

Riot says Vanguard "is made up of preventative and detective layers," aiming to block as many cheating methods as possible outright, and where blocking locally would expose the method, to instead passively detect the intrusion and act on a delay.

Environment attestation is central. Riot states that "Vanguard's primary goal is to confirm the game is currently running in an environment we can trust," and that the purpose of the kernel driver "is to monitor system state for integrity" and to make tampering harder. The driver loads at boot so that it can attest that nothing happened between Windows loading and the game starting. Riot says the driver keeps its own local blocklist of vulnerable drivers favoured by cheaters, and that if one appears, "we know the system is entering an insecure state, and Vanguard unloads." When a game is launched, the client contacts the driver to confirm the state is good before the player receives a valid anti-cheat session.

Riot also leans on hardware identity, describing TPM 2.0 as "an extremely non-fungible form of hardware ID."

On the server side, Riot says it uses machine models to predict the likelihood a player is cheating, and describes a separate "behavioral" server sided detection used in VALORANT. Riot has publicly stated that it does not action every detection immediately, and that it delays bans "based on the sophistication and visibility of the cheat and cheater."

Per Riot account, permanent for cheating in VALORANT; Riot separately issues hardware ID (HWID) bans that ban the physical computer and restrict any account used on it across Riot games

Scope depends on the penalty. For VALORANT, Riot states that cheating with unauthorized hardware or software "will get that player's account permanently banned," and that queuing with cheaters results in a 180 day ban. Riot also notes that because detections can be tied to hardware, "with hardware-level cheating, we can't always tell which game you intended to cheat on."

Separately, Riot issues hardware ID bans. Riot describes an HWID ban as banning "the physical components of that computer rather than just banning an account," and says another account logging in on that machine will be restricted and "will be banned for a set period."

Appeals exist. To contest a suspension, Riot says to submit a ticket to request an audit. For an HWID ban, Riot publishes a process: submit a player support request asking for re-evaluation, open a separate ticket per affected account, and Riot then investigates and makes a final call on whether to lift or extend the ban. Riot says a lift is possible but never guaranteed, and that threats of harm are not reconsidered.