Anti-cheat software used to live in user space. It ran alongside the game, watched for modified memory, checked file hashes, looked for known cheat processes. A cheat with the same privileges could hide from it, so publishers escalated. The current generation of anti-cheat for competitive titles ships a signed Windows driver that runs in ring 0, the privilege level that owns the machine.
Riot's Vanguard, bundled with Valorant since 2020 and extended to League of Legends in 2024, is the most discussed example because it loads at system boot rather than at game launch. Easy Anti-Cheat, BattlEye and several others use kernel components too, with differing lifecycles. The design decision is defensible on its own terms and it is worth being clear about what it costs.
Why publishers ended up here
The arms race is genuine, and privacy commentary that ignores it is not describing the situation.
Cheat development is a paid industry with subscription pricing and customer support. Its products moved into the kernel years ago, precisely because a kernel cheat can lie to any user-space observer about the contents of memory. A user-mode anti-cheat asking the kernel what a process contains gets whatever a kernel-resident cheat wants it to hear. Meeting that requires equal privilege.
The frontier has already moved past software. Serious cheating now uses a second computer with a PCIe direct-memory-access card reading the game machine's RAM over the bus, and a hardware device that injects mouse movements so the inputs look human to the game. Nothing running on the target machine, at any privilege level, sees either one. Kernel anti-cheat raises the cost of the cheap tier of cheating. It does not close the top tier, and the people selling to the top tier know it.
What a kernel driver can do
Capability and behaviour are different claims, and only the first is verifiable from outside. A ring 0 driver on Windows can read any process memory, enumerate every loaded module and open handle, inspect files regardless of permissions, hook system calls, and observe input. Vendors publish policies describing what they collect, and those policies may be accurate. There is no mechanism available to a user that would confirm it.
Not "is this vendor reading my documents," which you cannot check. It is "who else can reach this driver, what happens when it has a bug, and can I remove it." Those have concrete answers.
The failure that already happened
A signed kernel driver is a capability, and capabilities get borrowed. Bring-your-own-vulnerable-driver is an established technique: an attacker who already has administrator access loads a legitimately signed driver with a known flaw and uses it to reach kernel privilege, disable endpoint protection, or terminate processes that would otherwise stop them. Microsoft maintains a blocklist of drivers known to be abused this way, enabled alongside memory integrity on recent Windows installs.
In 2022, security researchers documented a ransomware operation abusing the anti-cheat driver shipped with a popular free-to-play title. The driver was signed, it was on the blocklist late rather than early, and the attackers loaded it onto machines that had never had the game installed, using it to kill antivirus processes from kernel space before encrypting the disk. The game's developers had done nothing malicious. They had written a driver, and someone else found a use for it.
That is the structural risk of an expanding population of third-party kernel code. Each driver is another candidate for the blocklist, and the blocklist is by construction a record of things that already went wrong. Reducing the amount of third-party code in the kernel is the direction Windows security has been moving since the July 2024 CrowdStrike update crashed millions of machines worldwide, an incident that had nothing to do with games and everything to do with what a defective kernel-mode component costs. Microsoft has since been working with endpoint security vendors on a platform that lets them operate outside the kernel. Anti-cheat is not part of that effort.
What you give up beyond the security question
| Consequence | Detail |
|---|---|
| Boot-time persistence | Some drivers load with the operating system and stay resident regardless of whether the game runs. Uninstalling the game may not uninstall the driver, which is often a separate entry in the installed-programs list. |
| Virtual machines blocked | The obvious mitigation, running the game in a VM, is detected and refused by most kernel anti-cheat, because a VM is also how you hide a cheat. |
| Platform requirements | Vanguard requires TPM 2.0 and Secure Boot on Windows 11, which is a hardware-backed ban mechanism as much as an integrity check. |
| Linux exclusion | Easy Anti-Cheat and BattlEye both offer Proton support that the publisher must enable, and many decline. Others provide no Linux path at all, which is the single largest category of games that will not run on a Steam Deck. |
| Conflicts with hardening | Kernel drivers have historically been the source of incompatibility with memory integrity and other Windows hardening features, so the presence of one can push a user toward turning protections off. |
What actually helps
Running as a standard user rather than an administrator is good practice and is not a mitigation here. The driver is already installed at that point, and it outranks the account model entirely.
- Separate the machine. A dedicated gaming machine, or a separate boot installation, is the only clean answer if the same computer holds work material, source code or a password vault. This is compartmentalisation, the same reasoning behind isolating high-value tasks from general-purpose use.
- Check the uninstall path before installing. Search the vendor's documentation for how the driver is removed, and confirm it appears as its own entry rather than living silently after the game is gone.
- Keep the vulnerable-driver blocklist and memory integrity on. If a game requires you to disable them, that requirement is the trade, stated plainly.
- Prefer titles that detect server-side. Statistical detection from gameplay telemetry, replay review and reputation systems catch a different population of cheaters without any client privilege, and some studios lean on them deliberately.
The publishers are solving a real problem, and competitive integrity is worth something to the people who play these games. The part that deserves scrutiny is that the decision is presented at install time, once, to someone who wants to play with their friends, and its consequences apply to the whole machine for as long as the driver stays. That is a large trust decision packaged as a checkbox, and it is the same packaging problem as monitoring agents arriving with a corporate laptop image. Knowing what you agreed to is most of the work.