This guide breaks down exactly what Vanguard does, what it doesn't do, which tools are safe, and which myths need to die. No speculation — just how it actually works.
Vanguard is Riot Games' proprietary anti-cheat system, built specifically for VALORANT. It consists of two components: a kernel-level driver (vgk.sys) that loads at system boot, and a user-mode client that runs when VALORANT is open.
The kernel-level driver is the part that generates controversy. It runs at Ring 0 — the deepest level of Windows, the same privilege level as your GPU drivers, your audio drivers, and Windows itself. This is not unusual for security software. Most anti-cheat systems, antivirus programs, and hardware drivers operate at this level.
Why does it need kernel access? Because cheats operate at kernel level. A user-mode anti-cheat (Ring 3) literally cannot see what a kernel-mode cheat is doing — it's like asking a security guard to monitor a room they're locked out of. The only way to detect kernel-level cheats is to operate at the same privilege level.
| Component | Privilege | When Active | Purpose |
|---|---|---|---|
| vgk.sys (driver) | Ring 0 (Kernel) | System boot onwards | Prevents cheats loading before VALORANT starts |
| vgc.exe (client) | Ring 3 (User) | Only when VALORANT runs | Active monitoring, cheat signature scanning |
| vgtray.exe (tray) | Ring 3 (User) | System tray icon | Status indicator, lets you disable/enable Vanguard |
Why does the driver load at boot? If Vanguard only started when you launched VALORANT, a cheat could load first and hide itself from Vanguard. By running from boot, Vanguard ensures nothing malicious is already in memory when the game starts. This is the same approach used by enterprise security solutions and other anti-cheat systems like EasyAntiCheat and BattlEye.
Vanguard's monitoring is targeted and specific. It is not a general surveillance tool — it exists to catch one thing: software that tampers with VALORANT's game process. Here is what it actively checks:
The common thread is clear: every check relates to game integrity. Vanguard is looking for software that interacts with VALORANT's process, not software that exists on your PC independently.
This is the section that matters most for the privacy-conscious. Despite running at kernel level, Vanguard has a strictly limited scope. Here is what it does not do:
The kernel driver's boot-time presence is purely defensive: it establishes a known-clean system state before VALORANT launches. When VALORANT is not running, the driver is essentially idle — consuming negligible CPU and no network bandwidth.
This is the question every VALORANT player asks before tweaking their system: "Will this get me banned?" The answer depends entirely on whether the tool interacts with VALORANT's process memory. Here is the definitive breakdown:
100% Safe — OS-level tweaks:
| Tool / Tweak | Status | Why It's Safe |
|---|---|---|
| Windows power plans (High Performance / Ultimate) | SAFE | OS setting — does not interact with any game process |
| NVIDIA Control Panel / AMD Radeon settings | SAFE | GPU driver settings — game-external configuration |
| Registry edits (Nagle's Algorithm, TCP, etc.) | SAFE | Windows networking stack — no game interaction |
| MSI Afterburner (GPU overclock/monitoring) | SAFE | Reads GPU sensors, doesn't inject into game processes |
| RTSS (RivaTuner Statistics Server) | SAFE | Frame limiter and OSD — uses DirectX hooks but is whitelisted |
| Discord overlay | SAFE | Whitelisted by Riot — uses approved overlay injection |
| Windows Game Mode / Game Bar | SAFE | Microsoft first-party — built into Windows |
| Valo Optimise | SAFE | Only modifies Windows settings — never touches game files or memory |
UNSAFE — These will get you flagged or banned:
| Tool / Action | Status | Why It's Dangerous |
|---|---|---|
| Cheat Engine (even for other games) | BANNED | Memory editor — Vanguard detects it regardless of target process |
| DLL injectors | BANNED | Code injection into running processes is a cheat signature |
| Driver-level input spoofing tools | BANNED | Simulating hardware input at driver level = aimbot infrastructure |
| Process Hacker / modifying VALORANT memory | BANNED | Any tool that reads/writes VALORANT process memory triggers detection |
| Kernel-mode exploits / vulnerable driver loaders | BANNED | Loading exploitable drivers is blocked at boot by Vanguard |
🎯 Halfway Through
Get notified when we publish our deep-dive on Vanguard updates and compatibility changes.
Free. Unsubscribe anytime.
The misinformation around Vanguard is persistent and widespread. Here are the claims that keep resurfacing — and what's actually true.
| Myth | Verdict | Reality |
|---|---|---|
| "Vanguard is spyware" | FALSE | Vanguard has been independently audited by security researchers. It monitors game-process integrity, not personal data. It sends no personal files, browsing data, or keystrokes to Riot. You can verify its network activity is zero when VALORANT is closed using any packet analyser. |
| "Vanguard causes BSODs all the time" | MOSTLY FALSE | BSODs from Vanguard are rare and almost always caused by conflicting kernel-level drivers — typically vulnerable anti-cheat drivers from other games, certain RGB lighting software drivers (like older iCUE versions), or outdated chipset drivers. Updating the conflicting driver or removing it resolves the issue. Vanguard itself does not randomly crash systems. |
| "Vanguard slows down my PC" | FALSE | The vgk.sys kernel driver uses less than 0.1% CPU and a minimal memory footprint (typically under 10MB). It is comparable to any other system driver. In benchmarks, there is no measurable performance difference with Vanguard enabled vs disabled. |
| "Vanguard reads all my files" | FALSE | Vanguard scans for cheat-related binaries using signature matching, similar to how antivirus works. It does not open, read, or transmit your documents, photos, or personal files. The file scanning is limited to executable signatures. |
| "Vanguard sends data to China / Tencent" | FALSE | Riot Games operates its own data infrastructure. Vanguard's telemetry goes to Riot's servers, not Tencent. While Tencent is Riot's parent company, Riot has repeatedly confirmed operational independence on data handling. Riot's privacy policy is public and auditable. |
| "You can't disable Vanguard without uninstalling" | FALSE | Right-click the Vanguard tray icon and select "Exit Vanguard." This disables the user-mode client. To fully unload the kernel driver, disable vgk from starting in msconfig or Services. VALORANT won't launch until Vanguard is re-enabled and you reboot, but you are always in control. |
| "Vanguard bans you for having Cheat Engine installed" | MOSTLY FALSE | Having Cheat Engine installed won't trigger a ban. Having Cheat Engine running while VALORANT is open will. Vanguard detects active memory-editing tools in memory, not programs sitting on your hard drive. That said, it's best practice to close Cheat Engine before launching VALORANT. |
If you want to verify Vanguard's status on your system — whether to confirm it's active before launching VALORANT, or to confirm it's disabled when you don't want it running — here's how:
Method 1: System tray icon
- Look at your system tray (bottom-right, near the clock)
- If Vanguard is running, you'll see the Vanguard shield icon
- Right-click it to see options: "Exit Vanguard" disables the user-mode client
Method 2: Task Manager
- Press Ctrl + Shift + Esc to open Task Manager
- Go to the Details tab
- Look for vgc.exe (user-mode client) and vgtray.exe (tray icon)
- If vgc.exe is running, the anti-cheat client is active
Method 3: Check the kernel driver
- Open Command Prompt as Administrator
- Run the following command:
If Vanguard's kernel driver is loaded, you'll see STATE: 4 RUNNING. If it's stopped or the service doesn't exist, the driver is not loaded.
To temporarily disable Vanguard:
- Right-click the tray icon → Exit Vanguard
- To prevent the driver from loading on next boot: press Win + R → type
msconfig→ Services tab → uncheck vgk → Apply → Restart - To re-enable: re-check vgk in msconfig and restart. VALORANT will require a reboot with Vanguard active to launch.
Vanguard is aggressive by design — because the cheats it's fighting are aggressive. Kernel-level anti-cheat is the industry standard for competitive shooters in 2026, and Vanguard is one of the most effective implementations, which is why VALORANT has consistently lower cheater rates than competitors.
Here's what you need to remember:
- Vanguard monitors game integrity, not your personal data. It checks for cheats interacting with VALORANT's process — nothing else.
- OS-level optimisations are completely safe. Power plans, registry tweaks, GPU settings, network tuning — Vanguard ignores all of it.
- Third-party overlays are fine. Discord, MSI Afterburner, RTSS, and GeForce Experience are all whitelisted or non-interfering.
- You can disable Vanguard whenever you want. Exit from the tray or disable the service in msconfig. You just need to reboot with it active before playing VALORANT.
- The "spyware" narrative has no evidence. Independent audits, network traffic analysis, and years of public scrutiny have not produced a single verified instance of Vanguard collecting personal data.
Valo Optimise is built with this understanding. Every optimisation in Valo Optimise works at the Windows OS level — modifying power plans, registry values, GPU driver settings, and network configuration. It never reads, writes, or interacts with VALORANT's game files or process memory. It is 100% Vanguard-safe, always has been, and always will be.
Optimise Without Fear.
Valo Optimise only touches Windows settings — never game files. Every tweak is Vanguard-safe and designed to maximise your FPS, reduce input lag, and stabilise your network.
Download Free — Windows 11/10No account required · 100% Vanguard-safe · 7-day free Pro trial included