BattlEye and Vanguard both run at kernel level, but they arrive differently. Vanguard installs a driver that starts with Windows and watches from boot. BattlEye loads when the game launches and unloads when it closes. The trade-off is coverage against convenience, and every major competitive game has picked a side.
Vanguard starts with Windows. BattlEye starts with the game
Vanguard is the aggressive one. Riot's anti-cheat installs a kernel driver that loads at system boot, before the game is anywhere near running. It stays resident, watching for cheat drivers and unsigned code, and it will block a game from launching if it finds something it does not like. Players who hate it usually hate this part: a game they are not playing is still running a driver on their machine.
BattlEye takes the lighter touch. Its driver loads when a protected game starts and unloads when the game closes. Nothing runs at boot, and nothing lingers after you quit. The cost is a blind spot: a cheat that loads before the game, or one that unloads the moment BattlEye wakes up, has a window to work in. That window is exactly what cheat developers aim for.
What kernel access actually buys the detector
Running in the kernel means seeing everything user-mode software cannot. A kernel driver can inspect memory reads, watch which processes touch the game, and catch injection attempts that a normal program would never notice. User-mode anti-cheat lives at the same privilege level as the cheats it hunts, which is a fair fight only if the cheat is sloppy.
The difference between the two systems is less about what they see and more about when they see it. Vanguard's always-on driver can catch a cheat loading at boot, before the game exists to be protected. BattlEye's on-demand driver sees everything from game launch onward, which is enough for most cheats, but not for the ones designed around the launch itself. DMA cheats, which read memory from a second PC through a PCIe card, dodge both approaches in different ways, which is why Riot started building extra checks on top.
The ban that follows, and why it sticks
Both systems ban accounts, and both can ban hardware. A hardware ban ties the punishment to the machine's identifiers, so a fresh account on the same PC gets flagged fast. Vanguard's boot-time presence makes its hardware fingerprint harder to spoof, since it can read identifiers before most spoofers load. BattlEye's bans lean more on behavioral patterns and on the account graph around the cheater.
For players, the practical difference is the install. Vanguard asks for trust at the operating system level and keeps asking for it every boot. BattlEye asks for trust for one session at a time. Neither is free, and neither is optional in the games that use them. The choice was made for you when the game picked its anti-cheat.
Which one players should actually worry about
The honest answer is that the anti-cheat matters less than the game around it. A kernel driver that catches 99 percent of cheaters in a game with no ranked integrity still leaves a bad experience. A weaker driver in a game with fast manual review and a real reporting pipeline can feel cleaner than either system on paper.
If you are choosing which game to grind, look at the ban waves, not the driver architecture. A game that bans in public, in batches, with numbers attached, is a game whose anti-cheat team is working. A game that never talks about bans is either not catching anyone or not trying. The driver is the tool. The bans are the proof.
Keep reading
Related guides on this site: what Vanguard runs on your machine and why players argue about it DMA cheats and the blind spot in the PCIe slot good bots vs bad bots and what the logs actually show More from Bot Protection For Games.
Frequently asked questions
Does Vanguard run even when I am not playing?
Yes. Vanguard's kernel driver loads at system boot and stays resident, which is how it watches for cheat drivers before the game launches. BattlEye only loads when a protected game starts and unloads when it closes.
Can a kernel anti-cheat see my files?
It has the privilege to inspect system memory and processes, which is the point. Both Riot and BattlEye say the drivers target cheat signatures and game memory, not personal files, and both have been audited, but the access itself is broad by design.
What is a hardware ban?
A ban tied to the machine's hardware identifiers rather than the account. A fresh account on the same PC gets flagged, which is why hardware bans hurt more than account bans and why spoofers try to change the identifiers.
Do DMA cheats beat kernel anti-cheat?
DMA cheats read game memory from a second PC through a PCIe card, so they do not run cheat code on the gaming machine at all. Kernel anti-cheat cannot see them directly, which is why Riot added extra checks like Vanguard On-Demand for games that face DMA abuse.