Some popular games require you to install software that runs at the deepest level of your operating system. Not just while you're playing. All the time. If you care at all about what's happening on your machine, this is worth understanding.
What Ring 0 Actually Is
Your operating system uses privilege levels to keep software from doing things it shouldn't. Normal apps like your browser or your games run at the outer level, called ring 3. They're supervised. They can only access their own memory, they can't touch other programs, and the OS can shut them down if needed.
Ring 0 is the kernel. It's where the OS itself runs, and it has unrestricted access to everything on the machine. No supervision, no restrictions. It's the layer that all other software ultimately answers to.
A useful way to think about it: the kernel is a building manager with a master key to every room. Regular apps are tenants. They can only access their own space. Ring 0 code is the building manager. When you install kernel-level anti-cheat, you're handing a copy of that master key to a gaming company.
In concrete terms, ring 0 code can:
- Read every keystroke before any app sees it, including passwords and anything typed into your bank's website
- Read RAM directly, which is where your password manager stores decrypted passwords while it's unlocked
- See your network traffic before it reaches your VPN, since ring 0 runs below that layer
- Disable or hide from your antivirus, because security software runs at the same level and cannot fully audit or restrict other ring 0 processes
- Install additional software silently, with no prompts and no UAC dialogs
- Keep running after you log out, because logging out only ends your user session, not kernel-level processes
The common response is "my antivirus will catch anything suspicious." It won't. Antivirus runs at the same privilege level as kernel drivers. A malicious or compromised ring 0 driver can blind it, feed it false data, or just turn it off. Your antivirus has no authority over ring 0 code.
You Cannot Verify What It's Doing
This is the part most people miss.
When a game company says their anti-cheat "only checks for cheating software," you have no way to confirm that. None. A ring 0 driver can read your keystrokes, scan your files, log your clipboard, make network requests, and do all of it silently while a monitoring tool tells you everything looks normal. The reason is simple: any tool you run to monitor it is a regular app running at ring 3. The kernel driver runs above it. It can lie to those tools. It can hide its own network connections, hide files it creates, hide processes it spawns.
You are taking the vendor's word for it. There is no independent verification mechanism available to you.
This would be true even if the company published their source code. The code running on your machine is a compiled binary delivered through an auto-updater. You're not compiling it yourself. The published source and the running binary could differ, and you would have no way to detect that. The next update could change behavior entirely, and again, you'd have no way to know.
So when evaluating kernel-level anti-cheat, the question isn't just "do I trust this company today." It's "do I trust every version of this software they will ever push to my machine, and do I trust that their update pipeline will never be compromised by someone else."
Vanguard Is Running Right Now
Most kernel anti-cheat drivers load when you launch the game and stop when you close it. Riot Vanguard works differently.
Vanguard installs two Windows components: a service called vgc and a kernel driver called vgk. Both start automatically when your computer boots. Not when you open Valorant or League of Legends. When you turn your computer on.
If you have Vanguard installed and you're not currently gaming, it's still running. While you check your email, while you do your banking, while you work. It starts before your VPN connects, before your password manager loads, before your antivirus initializes. Those tools are all starting up inside an environment Vanguard already controls.
To stop it from running, you have to fully uninstall Vanguard. Closing the game does nothing.
Who Built This and Why
The companies shipping kernel anti-cheat are not OS vendors. Microsoft and Apple have dedicated security teams, public vulnerability disclosure programs, and entire legal and reputational infrastructures built around protecting kernel integrity. Their kernel code is audited, reviewed, and updated with that responsibility in mind.
Game companies are optimizing for something different: keeping games fair so players don't quit. Those aren't the same goal as securing kernel-level access across millions of machines. Security investment competes with feature development, art production, and server costs for the same budget. Cheating hurts revenue in a visible, direct way. A security incident caused by the anti-cheat itself might not, depending on how disclosure plays out.
This isn't an accusation. It's just an accurate description of incentives. The result is kernel-level access deployed to solve a business problem rather than as a deliberate security architecture decision.
This Has Happened Before
In 2005, Sony BMG shipped music CDs that silently installed rootkit software on Windows PCs for DRM purposes. It hid itself from the OS, opened security vulnerabilities, and ran without user knowledge. It ended in congressional hearings, class action lawsuits, and became a landmark example of corporate software abuse.
In 2020, Riot Games shipped Vanguard. The technical architecture is comparable: a kernel-level driver that runs persistently and cannot be fully audited by the user. The difference in reception came down to framing. Sony installed without telling anyone. Riot asked you to click "agree" and framed it as competitive integrity infrastructure. The install is consensual. The architecture is the same.
How to Check Before Installing
Before you install a game:
- Search "[game name] kernel anti-cheat" or look it up on PCGamingWiki
- Watch for phrases like "boots with system," "runs at startup," or "requires restart to uninstall"
- Check if the anti-cheat appears as a Windows service that runs independently of the game
Linux compatibility is a useful shortcut. Games requiring kernel-level anti-cheat generally can't run under Proton or Wine because kernel drivers don't translate across operating systems. If a game runs fine on Linux, it probably doesn't have kernel-level anti-cheat.
Who This Actually Matters For
The risk looks different depending on what else is on your machine:
- If you do security research, bug bounty work, or pentesting, you likely have sensitive findings, credentials, and tooling on your machine that would be worth protecting
- If you use the same machine for personal and work purposes, a compromise of your machine is potentially a compromise of your employer's systems
- If you store SSH keys, API tokens, or credentials locally, those exist in memory and on disk while the driver is running
For someone using a dedicated gaming PC with nothing sensitive on it, the calculus is different. The risk is real either way, but what's at stake varies.
The question isn't whether kernel anti-cheat is risky. It is, by definition. The question is whether that risk is acceptable given what's on your machine and what alternatives exist.
Conclusion
Kernel-level anti-cheat grants a gaming company the same level of access to your hardware as your operating system. You cannot verify what it's doing. If it ever runs malicious code, whether through a breach, a supply chain attack, or a compromised update, your other security tools cannot stop it. Vanguard specifically runs continuously from boot, not just during gameplay.
That may be an acceptable tradeoff for some people and some machines. But it's a real tradeoff, and most people making it don't have the full picture. Now you do.