Kernel Anti-Cheat on Your PC: What It Can Actually Access

A reader who works as a bookkeeper asked me a pointed question last month. Her teenage son had installed Valorant on the family PC, and a colleague told her the game had put "spyware in the kernel" that started every time the computer booted. She runs client payroll on that machine. Should she be worried?

It is a fair question, and the honest answer is more interesting than either "it's fine" or "uninstall immediately". Kernel anti-cheat software does run with the highest privileges Windows offers. Whether that is a risk worth taking depends on what you use the computer for, and there are practical steps that reduce the exposure without banning anyone's favourite game.

What "kernel level" actually means

Windows separates software into layers. Ordinary programs like your browser run in user mode, where each one is fenced off from the others and from the core of the operating system. Drivers for hardware, plus some security tools, run in kernel mode, often called ring 0. Code there can see all memory, every running process and every file, and it loads before most other software.

Cheat developers moved into the kernel years ago, because from there a cheat can read a game's memory and hide itself from anything running in user mode. Anti-cheat vendors followed, since you cannot reliably catch kernel-level code from below it. That arms race is the whole reason this software exists.

The main ones you will meet on a home PC:

• Riot Vanguard, used by Valorant since its 2020 launch and by League of Legends since 2024. Its driver loads at boot, whether or not you play that day.
• Easy Anti-Cheat, owned by Epic, used in Fortnite, Apex Legends, Elden Ring and many others. It loads when a protected game starts and unloads after.
• BattlEye, used in PUBG, Rainbow Six Siege, DayZ and Arma. Also loads with the game.
• Ricochet, Activision's system for Call of Duty, with a kernel component active while the game runs.

That boot-time difference is the key distinction. A driver that runs only while a game is open is exposed for those hours. One that runs from boot is exposed every minute the machine is on.

The realistic risk is not spying

People usually worry that anti-cheat is reading their documents and sending them to a games company. I have not seen credible evidence of mainstream anti-cheat doing that, and the vendors have strong legal and commercial reasons not to. That fear is not where I would spend attention.

The real concern is that any signed kernel driver becomes a tool for attackers if it has a flaw. The clearest case so far involved Genshin Impact. In 2022, researchers at Trend Micro documented a ransomware group that installed mhyprot2.sys, the game's legitimately signed anti-cheat driver, on victims' machines and then used it to kill antivirus processes from kernel mode. The victims did not need to have the game installed; the attackers brought the driver with them because Windows trusted its signature.

The danger of a powerful driver is rarely what its makers do with it. It is what someone else can make it do.

Bugs in kernel code also crash the whole system rather than just one app. The July 2024 CrowdStrike outage, which grounded flights and knocked about 8.5 million Windows machines offline, was not anti-cheat, but it showed what a single faulty kernel update can do. Since then Microsoft has publicly discussed moving more security software out of the kernel, and I expect anti-cheat to be affected eventually, though I would not guess at a timeline.

Why "just uninstall the game" is the wrong default

For most households, removing every game with kernel anti-cheat is out of proportion to the risk, and it causes family arguments that end with the teenager installing it again anyway. The more useful approach is to match the exposure to the machine's role.

A shared PC that also handles work or money

This was the bookkeeper's situation, and here I would separate the roles. The cleanest option is a separate Windows user account for work with no admin rights, plus full-disk encryption with BitLocker. Better still, keep client data on a work laptop that never has games installed. Kernel drivers ignore user account boundaries, so the separate account limits other risks rather than this one, but it still raises the bar overall.

A dedicated gaming PC

If the machine is mainly for games, the risk is mostly about stability and keeping drivers current. Update the games regularly, because anti-cheat updates often patch exactly the kind of flaws attackers would look for.

How to see what is loaded

You can check which anti-cheat drivers are installed in a couple of minutes. Open a Command Prompt and run driverquery. Look for names such as vgk (Vanguard), EasyAntiCheat, BEDaisy (BattlEye) or similar. For a clearer view, Microsoft's free Autoruns tool from the Sysinternals suite has a Drivers tab showing everything set to start with Windows, along with who signed it. Our list of free security tools worth setting up first covers where to download Sysinternals safely.

For Vanguard specifically, you can exit it from the system tray icon, though the driver returns at next boot. If nobody has played Valorant or League for weeks, uninstalling Riot Vanguard from Settings, then Apps, removes the boot-time driver entirely. It reinstalls the next time someone launches a Riot game.

One thing anti-cheat does not protect you from is fake cheats and "unlock tools", which are some of the most common malware delivered to young players. We covered that in the guaranteed win tool that is actually malware, and it is a far bigger risk than any legitimate anti-cheat driver.

What I told the bookkeeper

Her real exposure was not Vanguard. It was payroll data on a shared family PC with one admin account and no encryption. We set up a separate standard account for her work, turned on BitLocker, enabled two-factor authentication on her accounting software, and left Valorant alone. Her son agreed to uninstall Vanguard during tax season, which seemed a reasonable trade. The general priorities are in the handful of security habits that matter most.

Five minutes this week

Run driverquery on every PC in your house that has games installed, and note any anti-cheat names. For each, ask one question: does this machine also hold work files, banking access or client data? If yes, move that sensitive work to a separate account or, better, a separate device. If no, simply keep the games updated and leave the driver alone.