Riot dev explains Valorant’s anti-cheat kernel driver and why it activates when you boot your PC

Back when Riot first announced Valorant, the studio talked briefly about plans to have ultra responsive servers and a proprietary anti-cheat system. Now we know a bit more about that anti-cheat system, as it installs as a kernel driver on your PC and activates as soon as your PC boots up.

The kernel anti-cheat driver is called ‘vgk.sys', so if you have Valorant installed on your PC, you may notice that in your list of background processes, even when not running the game. For comparison, systems like VAC, BattlEye and EasyAntiCheat all load up once you launch a game and don't run in the background after closing the game down.

One developer, known as RiotArkem on Reddit, wanted to alleviate concerns of snooping or unwanted file scans while not playing the game, giving the following explanation: “Vanguard contains a driver component called vgk.sys (similar to other anti-cheat systems), it's the reason why a reboot is required after installing. Vanguard doesn't consider the computer trusted unless the Vanguard driver is loaded at system startup (this part is less common for anti-cheat systems).”

The reason for this is that cheaters can bypass anti-cheat systems by loading the cheats themselves before the anti-cheat system has a chance to start. Running the anti-cheat driver at startup makes it harder for cheat software to tamper with the main game.

However, there are still understandable security concerns here, as a flawed driver with escalated privileges could spell disaster and provide an entry point for hackers to run rogue code without the user knowing. With that in mind, RiotArkem explains that the studio has consulted “multiple external security research teams” to review it for flaws. The driver component of the anti-cheat system is also supposed to do “as little as possible”, passing on the majority of the work to the non-driver component, which doesn't kick in until Valorant is actually launched.

The driver “does not collect or send any information” about the user's PC back to Riot and any cheat detection scans will take place when Valorant is running. With that in mind, it should not be scanning your PC in the background without your knowledge. Finally, the Vanguard driver (vgk.sys) can be uninstalled from your PC at any time, although the studio assures that it does not communicate over networks or collect information from your PC.

Discuss on our Facebook page, HERE.

KitGuru Says: It doesn't seem that this will be a huge security issue, but Riot will need to keep its ears open to the cyber security community and act swiftly in the event of significant flaws, not just for the protection of the game, but for the protection of users that have it installed.

Become a Patron!