PC anti-cheat in 2026 is starting to look less like a single piece of security software and more like a chain of trust spread across firmware, Windows, game clients, and remote services. Riot’s Vanguard has made the clearest architectural move so far, adding an optional on-demand mode that no longer needs its kernel driver running from system startup on sufficiently secured Windows 11 PCs. Easy Anti-Cheat, meanwhile, still uses kernel-level protection in major titles such as Fortnite, while Epic is pairing that local protection with behavioral analysis, statistical detection, machine learning, and server-side enforcement. The useful comparison is no longer simply “which product has ring-0 access?” It is which parts of the anti-cheat job still need ring 0, which parts can be trusted to Windows, and which detections work better after gameplay data leaves the player’s machine.
Vanguard’s Biggest Change Is When the Driver Has to Be Present
Vanguard earned its reputation through persistence. Riot originally designed its kernel driver to start with Windows so it could maintain continuity from boot to game launch, reducing the chance that a vulnerable or malicious driver could run first, map a cheat into kernel space, disappear, and leave a later anti-cheat blind to what happened. Riot described this as a “who loads first” problem, and the boot-start model gave Vanguard a way to preserve a local trust chain before VALORANT or League of Legends ever opened. That architecture was aggressive, but it addressed a real weakness in any anti-cheat that enters the system only after an attacker has already modified the environment.
In June 2026, Riot introduced Vanguard Pre-Check and optional on-demand operation for PCs that satisfy a stricter Windows security baseline. On qualifying systems, the Vanguard driver can load with the Riot game and stop running afterward instead of starting at boot. Riot requires at least Windows 11 25H2 plus UEFI Secure Boot, TPM 2.0, virtualization-based security, Hypervisor-Protected Code Integrity, and IOMMU support for this mode. Riot said about 35 percent of its players already met the requirements when the feature was announced, while everyone else could continue using the older always-on model.
The technical reason this became possible matters more than the taskbar icon disappearing. Riot says newer Windows functionality can provide a Runtime Driver Attestation Report that records drivers entering the system and binds those measurements to the TPM. Vanguard can therefore inspect a trustworthy history of driver activity even if its own driver was not present from boot. That transfers part of the job from Riot continuously watching the kernel to Windows proving what happened inside it.
Windows Is Becoming Part of the Anti-Cheat Perimeter
Microsoft’s own security changes make that direction easier to see. Beginning with April 2026 updates, Microsoft tightened kernel driver trust on current Windows 11 releases, moving systems toward WHCP-signed drivers and away from the older cross-signed driver program. Microsoft also continues to block known vulnerable drivers through Code Integrity protections, the same broad class of weak driver that cheat developers have historically abused to gain kernel access. In September, Microsoft announced that memory integrity will begin turning on across more eligible Windows devices starting in October 2026, with virtualization-based security enabled on some systems as part of that rollout.
That does not remove the value of a game-specific kernel component. It changes how much custom anti-cheat code may need to remain resident and how much evidence can come from the operating system itself. If Windows can attest to boot state, loaded drivers, code integrity, and virtualization-backed protections, an anti-cheat can spend less effort recreating those checks and more effort examining events that are specific to the game. The long-term engineering incentive is clear: keep privileged code as small and purpose-specific as possible, then move policy, correlation, account history, and expensive analysis to services that are easier to update.
This is where the phrase “lighter kernel stub” needs care. Riot has publicly confirmed an on-demand driver, not the elimination of its kernel component, and Epic has not announced that Easy Anti-Cheat has been rewritten into a minimal kernel stub. The broader 2026 trend supports thinner, less persistent privileged components because Windows can now provide stronger platform evidence, but product implementations still differ. Treating “kernel anti-cheat is going away” as an established fact would get ahead of what Riot, Epic, and Microsoft have actually published.
Easy Anti-Cheat Is Still Kernel-Based, but Detection Is Spreading Outward
Easy Anti-Cheat represents a different deployment model because it protects a large range of games rather than a tightly controlled set of Riot titles. Epic’s own support material still states that EAC requires kernel-level access, and its troubleshooting guidance documents cases where Windows kernel-mode hardware-enforced stack protection can prevent certain EAC games from launching. Fortnite’s 2026 competitive anti-cheat guidance likewise says Easy Anti-Cheat uses kernel-level protection while the broader system watches suspicious behavior through data and machine learning. That combination is the important part: kernel access remains active, while more judgment happens through telemetry and behavioral evidence.
Rocket League provides another 2026 example of that wider model. When EAC became mandatory for online PC play in April, Psyonix described it as using behavioral analysis and proactive detection against cheating and botting, while also supporting Steam Deck and Linux. The public description does not expose enough implementation detail to map every check to kernel mode, user mode, or backend processing, but it confirms that EAC’s value proposition is broader than scanning memory for a known cheat binary. Detection increasingly depends on patterns, repeat behavior, enforcement history, and data that can be compared across matches.
Epic has been explicit about the same layered approach in Fortnite. Its published anti-cheat material describes kernel protection alongside statistical analysis and machine-learning methods used to identify suspicious activity. That matters because some of the hardest modern cheats avoid obvious game-process tampering altogether. External hardware, computer-vision systems, input automation, and DMA-based techniques can reduce the local software evidence available to a traditional scanner, which makes player behavior and trusted platform state more valuable detection signals.
Behavioral Detection Changes What Anti-Cheat Can See
A kernel driver is good at answering questions about the machine. It can help determine which drivers are loaded, whether protected memory is being touched, whether the game process has been manipulated, and whether suspicious low-level activity is occurring. Behavioral detection asks a different set of questions: how the player aims, how inputs are timed, how performance changes across situations, whether actions repeatedly exceed plausible human patterns, and whether the same account or device exhibits suspicious sequences over time.
Riot has publicly described a server-side behavioral detector for VALORANT that uses in-game performance data, separate from classifications for kernel cheats, DMA, pixelbots, and other technical vectors. That distinction is significant because the server does not need to identify the exact cheat executable to decide that a pattern deserves action. It can judge the output produced by the player-cheat combination, which is especially useful against methods designed to keep the gaming PC looking clean.
Cloud-side analysis also has an operational advantage. Models, thresholds, and correlation logic can change without shipping a new privileged driver to millions of PCs, and evidence can be compared against much larger populations than a single machine can observe. False positives remain the hard problem, especially when elite players naturally produce unusual statistics, so serious systems need multiple signals and strong evidence before enforcement. Epic says Fortnite bans for cheating are based on technical evidence rather than suspicion, which reflects how high the cost of a bad automated decision can be in a competitive game.
The user-mode layer still matters in this arrangement, even when the heavy analysis happens remotely. A game client or anti-cheat service can collect permitted telemetry, coordinate local checks, communicate attestation results, and package match information for backend analysis without giving every detection routine kernel privileges. That creates a natural division of labor: kernel code handles checks that genuinely require privileged visibility, user-mode components handle orchestration and data collection, and remote systems handle correlation across matches, accounts, and larger player populations.
Vanguard and EAC Are Converging on Layers, Not Identical Architecture
The difference between Vanguard and EAC in 2026 is partly about ownership. Riot controls the games, the anti-cheat, the account system, and much of the security policy around the PC environment, so it can impose a strict baseline and design Vanguard around those exact requirements. EAC has to fit many publishers, engines, operating environments, and support policies, which favors a more adaptable package with local protection plus backend services that can be configured around each title.
Both approaches now point toward the same layered security model. Hardware-backed trust and Windows security features establish whether the PC environment is credible, a local anti-cheat component protects the running game and collects high-value signals, and remote systems correlate behavior across sessions. Microsoft Azure Attestation is appearing elsewhere in competitive gaming for the same reason. Activision’s RICOCHET system added remote Azure Attestation for Ranked Play in 2026, verifying PC integrity before players enter protected competitive queues.
For competitive players, this architecture changes the argument around anti-cheat overhead and privacy more than it changes the need for strong detection. A smaller or on-demand kernel presence can reduce the amount of privileged code that stays active outside a game session, while attestation gives publishers another way to reject compromised environments before a match starts. At the same time, stronger behavioral systems mean anti-cheat is increasingly interested in what happens during play, not only what software is installed. The trade becomes less about choosing between client-side and server-side detection and more about deciding which evidence belongs at each layer.
The Next Anti-Cheat Fight Is Over Trust, Not Ring Numbers
Kernel access will remain useful as long as cheat developers can operate in kernel space, abuse vulnerable drivers, or use hardware paths that bypass ordinary user-mode visibility. The 2026 shift shows that permanent kernel residency is no longer the only way to establish trust on a modern Windows PC. Vanguard Pre-Check is the clearest proof: Riot can let its driver arrive later because Windows can preserve evidence about what happened earlier. EAC has not publicly made the same architectural move, but Epic’s current anti-cheat strategy already combines kernel protection with behavioral and machine-learning detection outside that narrow layer.
That leaves anti-cheat developers with a more interesting engineering problem than simply pushing deeper into the operating system. They can ask Windows and hardware to prove platform integrity, keep only the privileged checks that truly require kernel access, and send the harder pattern-recognition work to systems that can compare thousands or millions of matches. Competitive gaming is moving toward that split because modern cheating has already spread across software, firmware, external hardware, and generated input. The anti-cheat stack has to follow the evidence wherever it exists.