Kernel-level anti-cheat installs a signed driver at Ring 0, the most privileged layer of the operating system, where it can read any process memory and see every other driver that loads. Riot Vanguard, Activision's Ricochet, Easy Anti-Cheat, and BattlEye all work this way, because cheats moved into the kernel first: a cheat running as a kernel driver can read the game's memory while hiding from everything above it. The real argument is about footprint. Vanguard historically loaded at Windows boot and stayed resident, while Ricochet, Easy Anti-Cheat, and BattlEye load with the game and unload when it closes.
Why the kernel at all
User-mode anti-cheat lost the fight the moment cheat developers started shipping kernel drivers. A normal application cannot reliably inspect code that sits below it in privilege, so a cheat that loads as a driver can read game memory, spoof input, and hide from every scanner running above it. The only way to watch it is to run at the same level. That is the whole case for kernel anti-cheat, and it is a real one: signature scanning from user mode cannot see a kernel cheat at all.
What a kernel driver actually does with that access is narrower than players assume, and broader than publishers admit. The documented work is scanning memory and disk for known cheat signatures, detecting code injection into the game process, checking for tampering with the game's own files, and watching for other drivers that match known cheat-driver patterns. Vanguard's boot-time loading existed specifically to catch cheat drivers loaded before a match starts. What the vendors say they do not do is log general keyboard and mouse activity outside the game or browse personal files, and there is no publicly confirmed case of a major anti-cheat being exploited to compromise a player's system.
The part players feel is the hardware fingerprint. All five major systems collect firmware-bound identifiers, motherboard serial, SMBIOS data, disk serials, and MAC addresses, to issue hardware bans that follow the machine rather than the account. An account ban costs a cheater a login. A hardware ban costs them the PC, at least until they swap parts.
The five systems, and where they differ
Vanguard is the outlier on footprint. It ships with Valorant and League of Legends, historically loaded at Windows boot, stayed resident whether or not the game was open, and requires TPM 2.0 and Secure Boot to play at all. That always-on design drew the most sustained backlash of any anti-cheat, and in June 2026 Riot made boot-time loading optional: on a PC that passes its Pre-Check, Windows 11 version 25H2 or newer with Secure Boot, TPM 2.0, IOMMU, virtualization-based security, and memory integrity, the driver can load on demand instead.
Ricochet, which ships with Call of Duty, loads with the game and stops when the player exits. It has pushed hardest on verification instead of persistence, adding cloud attestation to confirm TPM and Secure Boot through Microsoft's servers before ranked play. BattlEye, used in PUBG, Rainbow Six Siege, and Escape from Tarkov, also loads with the game and is otherwise inert, and its global bans are permanent with no exceptions. Easy Anti-Cheat follows the same session lifecycle, and its defining trait is cross-game ban sharing: a hardware ban in one EAC title can lock a player out of others.
The security record is mixed in a way both sides should admit. EAC had a local privilege-escalation flaw, CVE-2021-47739, rated CVSS 8.5, found in 2021 and only assigned a CVE in December 2025. Researchers have found weaknesses in BattlEye that let an attacker load a malicious unsigned driver. A driver with this much access adds attack surface if it is ever compromised, and that risk is the honest price of the whole approach, not a talking point.
What this means for a team shipping a game
The choice is not between kernel anti-cheat and no anti-cheat. It is between the footprint players will accept and the detection a team actually needs. A session-based driver that loads with the game and unloads at exit catches the cheats that matter during play and costs the team far less trust than a boot-time resident. BattlEye is the proof that a purpose-limited kernel driver is possible; the others chose differently, and the difference shows up in every community thread about their game.
Whatever the choice, say what the driver collects in plain language. Riot's FAQ is more specific than most: it states the team is not shipping back files or documents, that signature scans return only true or false, and that Vanguard logs the file path of every library loaded into the game. It also admits a limit, in its own words: it cannot tell players every single thing Vanguard looks at. That admission is worth more than a page of reassurance, because players can tell when a privacy disclosure is a wall of text and when it is an answer.
Frequently asked questions
Is kernel-level anti-cheat safe to install?
It runs with the same system privileges as antivirus software, and the major vendors use that access to scan for cheat signatures rather than log general activity. The documented risk is not misuse but attack surface: a driver with this much access is a target, and EAC has had a privilege-escalation flaw, CVE-2021-47739, rated CVSS 8.5.
Does Vanguard still run at Windows boot?
Not necessarily. In June 2026 Riot made boot-time loading optional. On a PC that passes its Pre-Check, Windows 11 version 25H2 or newer with Secure Boot, TPM 2.0, IOMMU, virtualization-based security, and memory integrity, the driver can load on demand instead of at boot.
What is a hardware ban, and how is it different from an account ban?
A hardware ban fingerprints the machine, using motherboard serial, SMBIOS data, disk serials, and MAC addresses, and blocks that hardware from playing. An account ban costs a cheater a login. A hardware ban follows the PC, so the cheater has to swap parts or use another machine.
Do Ricochet, BattlEye, and Easy Anti-Cheat run all the time?
No. They load with the game and unload when it closes, so they are not monitoring the PC between sessions. Vanguard was the exception with its boot-time resident driver, and even that became optional in June 2026.