Kernel-level anti-cheat loads a driver that runs with the same privileges as the operating system, so it can inspect memory and processes that user-level software cannot reach. That access is what makes it effective against cheats, and it is also the reason players argue about it.
What kernel level actually means
Most software on a computer runs in user mode, where the operating system limits what it can see and touch. A kernel driver runs in kernel mode, with the same privileges as the operating system itself. Vanguard's driver loads when the computer starts and stays resident, which means it is running whether or not the game is open. That is the part players object to most, and it is also the part that makes the system work.
The reason games moved to the kernel is that cheats got there first. A modern cheat can hide in a driver, read game memory from outside the game process, and feed information to an overlay the game cannot see. A user-level anti-cheat cannot inspect what a kernel-level cheat is doing, because the cheat sits above it in privilege. The game moves its detection to the same level to keep the fight even, and that is a technical argument, not a marketing one.
Related reading on this site: Home and Good Bots vs Bad Bots: What the Logs Actually Show cover the neighbouring problems in more depth.
What it catches that user-level anti-cheat misses
The clearest win is hardware-linked accounts. Vanguard can see the machine, not just the account, which is why it matters for smurf detection. A new account on a machine with a banned or high-ranked history looks different from a new account on a new machine, and that hardware link is one of the signals ranked queues use to spot alt accounts. A user-level system sees a fresh install. A kernel-level system sees the same machine that was banned last week.
The second win is cheat detection that survives a reinstall. A cheat that lives in a driver or in firmware does not disappear when the player uninstalls the game and reinstalls it. Kernel-level detection can find it because it inspects the same layer the cheat lives in. The tradeoff is real: the same access that finds the cheat is the access players worry about, and no amount of reassurance changes the fact that the driver is running on their machine all day.
The argument players keep having
Riot says the driver does not collect data when the game is not running, and that it only inspects what it needs to for cheat detection. Players who distrust that answer point out that the driver could collect more, and that trust is doing a lot of work in the arrangement. Both sides are right about the facts. The driver is loaded, and the driver is not collecting game data while the game is closed. The argument is about whether that is enough.
The practical question for a player is simpler than the philosophy. If you play a game with kernel anti-cheat, you have accepted a driver with operating system privileges on your machine. If that bothers you, the honest answer is to play games without it, because no setting turns the driver off while the game runs. The middle position, playing the game while complaining about the driver, is where most players land, and it is also where the argument never ends.
Frequently asked questions
What is kernel-level anti-cheat?
It is anti-cheat software that runs a driver at the kernel level of the operating system, the same privilege level as the OS itself. From there it can inspect memory, drivers, and processes that ordinary applications cannot see.
Why do games use kernel-level anti-cheat?
Because modern cheats also run at the kernel level or hide in drivers. A user-level anti-cheat cannot see what a kernel-level cheat is doing, so the game moves its own detection to the same level to keep the fight even.
Does Vanguard run when the game is closed?
Vanguard's driver loads when the computer starts and stays resident, which is the part players object to most. Riot says the driver does not collect data when the game is not running, but the fact that it is loaded at all is the core of the argument.
Can kernel anti-cheat ban a smurf account?
It can link accounts by hardware. A new account on a machine with a banned or high-ranked history looks different from a new account on a new machine, and that hardware link is one of the signals queues use to spot alt accounts.