Vanguard On-Demand is an opt-in kernel check Riot added in June 2026 for League of Legends. It runs a fresh driver verification at game launch for players who turn it on, targeting DMA cheats that load after boot and dodge the always-on driver. It is Riot admitting the boot-time driver has a gap, and patching it with a second look.
The gap the always-on driver could not close
Vanguard's strength is that it loads at boot and watches everything from the start. Its weakness is that cheats adapted to it. A DMA cheat does not run code on the gaming PC at all. It reads memory through a PCIe card from a second machine, and it can be attached after boot, after Vanguard has already done its early checks and settled into its routine.
The result was a class of cheats that the always-on driver could not see, because there was nothing to see on the machine it protects. The cheat lives on another PC entirely. Riot's answer was not a bigger driver. It was a second check, timed differently, aimed at the exact moment the cheat has to be present to work.
What On-Demand actually does at launch
When a player opts in, Vanguard On-Demand runs a kernel verification at the moment the game launches. It checks the driver state fresh, looks for the hardware signatures associated with DMA cards, and verifies the system in the state it is in right then, not the state it was in at boot. A DMA card plugged in after boot is visible to this check in a way it was not to the boot-time sweep.
The opt-in part matters. Riot did not force the check on every player, because a kernel check at launch adds friction: slower starts, more false positives on unusual hardware, more support tickets from players whose setups look strange. Players who opt in are mostly ranked grinders who would rather wait a few extra seconds than play against a DMA cheater. Casual players stay on the standard driver, and Riot accepts the coverage gap there.
Why cheaters keep moving the goalposts
Every anti-cheat measure has a shelf life. The moment On-Demand shipped, cheat developers started testing which DMA cards it flags and which it misses, and which timing tricks let a card stay hidden through the launch check. That is the normal cycle: detection ships, cheats adapt, detection adapts again.
The pattern to watch is not whether On-Demand catches cheats today, but whether Riot keeps updating what it looks for. A launch-time check that never changes its signatures becomes a speed bump within months. A check that updates weekly, tied to the ban waves, stays a real barrier. The driver is the delivery mechanism. The signature updates are the actual defense.
What it means for the average ranked player
For most players, On-Demand changes nothing. It is opt-in, it only runs at launch, and the cheats it targets are a small share of the cheating population. The bigger share is still account buyers, script users, and the ordinary aimbot crowd that the standard driver already catches.
Where it matters is at the top of the ladder, where DMA cheats concentrate because the stakes justify the hardware. If you are grinding high ranked and you have not opted in, turn it on. The extra seconds at launch cost you nothing, and the check is aimed at exactly the cheaters who ruin the games that matter most.
Keep reading
Related guides on this site: DMA cheats and the blind spot in the PCIe slot what Vanguard runs on your machine and why players argue about it how ranked ladders spot a veteran on a fresh account More from Bot Protection For Games.
Frequently asked questions
Is Vanguard On-Demand mandatory?
No. It is opt-in, added for League of Legends in June 2026. Players who turn it on get a fresh kernel verification at game launch. Players who do not keep the standard always-on Vanguard driver.
What is a DMA cheat?
A cheat that reads game memory through a PCIe card from a second PC, instead of running cheat code on the gaming machine. Because nothing suspicious runs on the protected PC, standard anti-cheat cannot see it directly.
Why check at launch instead of at boot?
A DMA card can be attached after boot, so a boot-time check misses it. A launch-time check looks at the hardware state in the moment the game starts, when the cheat has to be present to work.
Does On-Demand slow down my game?
It adds a few seconds at launch while the verification runs. It does not run during the match, so it has no effect on frame rate or input latency once you are in game.