Every online game depends on an invisible referee. When you load into a ranked match, software running on your PC and on the game’s servers is quietly comparing your session against known cheat signatures, watching for behavior that does not match a human player, and deciding whether your account stays in good standing. That software is anti-cheat, and it is one of the least understood parts of modern gaming. This guide explains how the three most widely used PC anti-cheat systems – Riot Vanguard, Epic’s Easy Anti-Cheat, and Valve’s VAC – actually work, why some run as kernel-mode drivers, and what a ban really means for your account.
Why anti-cheat exists
Cheating is as old as competitive multiplayer itself. The core problem is simple: a cheat gives one player an advantage that others do not have, whether that means aiming assistance, seeing opponents through walls, or automating inputs that a human would have to perform by hand. When cheats go undetected, they drive legitimate players away, which is why nearly every competitive online game ships with some form of anti-cheat.
Valve draws the boundary clearly in its own documentation: Valve Anti-Cheat classifies any third-party modification to a game designed to give one player an advantage over another as a cheat or hack that will trigger a ban. That definition is a useful baseline for the whole category. Anti-cheat systems exist to detect that specific category of software – not to police how you play, but to remove the unfair advantage a cheat provides.
How anti-cheat detects cheats
There is no single detection method. The systems covered here mix at least two broad approaches, and understanding the difference explains most of the debate around them.
The first approach is signature detection, and Valve’s VAC is the clearest example. Valve describes VAC as an automated system designed to detect cheats installed on users’ computers, and it explains that the system reliably detects cheats using their cheat signatures. In practice, this means Valve maintains a catalog of identifying fingerprints for known cheat files and matches a running game against that catalog. Valve is explicit about scope: this includes modifications to a game’s core executable files and dynamic link libraries – the actual program files a cheat would tamper with. Valve also states that a system’s hardware configuration and updated video drivers will not trigger a VAC ban, drawing a line between legitimate system state and actual cheats.
The second approach is behavioral and statistical. Epic describes Easy Anti-Cheat as a prevention-first service that detects sophisticated and evolving cheats using heuristics, gameplay analysis, and player report signals. Where signature detection looks for a known cheat file, this approach watches how a session actually behaves and combines that with reports from other players. Valve confirms the same philosophy on its side: users are not VAC banned based on reports alone, meaning player reports feed an investigation rather than triggering a ban by themselves.
These approaches are complementary, not competing. Signature detection is fast and precise against known cheats but only catches cheats the vendor has already seen. Behavioral analysis can flag new or private cheats but is harder to make precise. Most serious anti-cheat deployments use some combination of both.
The kernel-mode driver question
The most controversial part of anti-cheat is not whether it runs, but where it runs. Riot is the most transparent of the three vendors on this point: Riot Vanguard consists of a client that runs while our games are active along with a kernel mode driver. That single sentence is the source of most of the concern around Vanguard, so it is worth explaining.
Your operating system is divided into privilege layers. A normal application runs in user mode, where it can only see and touch its own memory and must ask the operating system for anything else. The kernel is the core of the operating system, and kernel mode has the highest privilege on the machine. A kernel-mode driver can inspect the system more deeply than a user-mode program can, which is precisely why anti-cheat vendors use it: a cheat that hides in a driver or tampers with a game’s memory is harder to see from user mode. The trade-off is that a kernel-mode driver from a game company is powerful software, and users are right to ask what it does.
Riot addresses this directly. The company states that Vanguard was developed in-house through extensive testing, is reviewed internally and through external security audits by industry experts, and was built with data privacy in mind, working with legal and compliance teams to adhere to regional data privacy laws. Riot also gives users visibility into the tool: Vanguard includes a system tray icon that shows its status, and a Pre-Check feature that lets you start and stop Vanguard on demand if your system meets the requirements.
The practical consequence is that Vanguard is usually an on-boot application. Riot’s documentation notes that if you disable Vanguard and later want to play a game that requires it, such as League of Legends or VALORANT, you will have to restart your computer – unless Pre-Check is available on your system. This always-on nature is a deliberate design choice, not an accident: it lets the anti-cheat establish a trusted state before a game launches.
Riot Vanguard, Easy Anti-Cheat, and VAC side by side
The three systems take visibly different approaches, which is useful when you are deciding what to play.
Riot Vanguard is Riot Games’ custom game security software, required to remain active while you play most Riot games. Its defining features are the kernel-mode driver and the always-on client described above. Riot also states that Vanguard automatically enables security standards similar to Windows Secure Boot while it is running, and that it informs users through a Windows notification about the vulnerable vectors it is affecting.
Easy Anti-Cheat is a service rather than a single game’s tool. It is part of Epic Online Services, and Epic positions it as a modular, layered system that developers configure for their own games, from free basic protection up to paid Core, Advanced, and Premier tiers for more competitive environments. Its stated platform support matters for players on less common setups: Epic lists Windows, Mac, Linux, and Steam Deck, and notes compatibility with crossplay on console.
Valve’s VAC is the oldest and most restrained of the three. It is an automated system tied to Valve’s own servers, and its reach is specific: if you connect to a VAC-secured server with identifiable cheats installed, VAC bans you from playing that game on VAC-secured servers in the future. Valve is careful about who can issue these bans – server administrators cannot issue VAC bans – and about what does not count, listing hardware configuration and updated drivers as non-triggers. VAC’s documentation does not describe a kernel-mode driver the way Riot’s does; it frames the system around signature matching on the games it protects.
None of this means one system is simply better. Each reflects a different publisher’s priorities: Riot wants deep, always-on enforcement for its own games, Epic wants a flexible service other developers can adopt, and Valve wants a server-based system that stays out of the way until a known cheat appears.
What a ban actually means
Ban policies vary, but Valve’s documentation is the most detailed and is worth reading closely, because the rules are stricter than many players assume.
Valve states that VAC bans are permanent, non-negotiable, and cannot be removed by Steam Support, and that they cannot be appealed. The one exception is procedural: if a VAC ban is determined to have been issued incorrectly, Valve says it will automatically be removed after investigation – but Steam Support does not manually remove VAC bans for any reason. The trigger is also defined precisely: a VAC ban is applied when an account, or an account using the phone number tied to other accounts, connects to a VAC-secured server while running cheat software. That phone-number detail means the consequence can extend beyond a single account.
Two more rules matter. First, Valve will not tell you which program caused the ban; the company says it has detailed records but does not disclose them because it would only help cheat developers. Second, the responsibility for your account is absolute: bans remain regardless of who was using the account at the time, so lending your machine or sharing a library does not protect you.
There are limits to a VAC ban, and they are worth knowing. A VAC ban applies only to the advantage of cheating on VAC-secured servers; Valve notes that cheat software for single-player or offline games does not trigger a ban because it provides no advantage on a VAC-secured server. Banned accounts can still play single-player, and for games that offer insecure, non-VAC servers, a banned player can still join those. Valve also warns that if someone you share your Steam library with cheats, your Family Sharing privileges may be revoked and your account may be VAC banned, and that VAC-banned games cannot be shared between accounts.
Privacy and security trade-offs
The honest summary is that anti-cheat is a trust decision. A kernel-mode driver can inspect your system at a level that a normal application cannot, and you are taking the vendor’s word that the software does only what it says. Riot is unusually explicit about how it addresses this: in-house development, external security audits, a privacy notice, regional data-privacy compliance, and a tray icon that gives you visibility into Vanguard’s status. Epic frames Easy Anti-Cheat primarily as a developer service, so its own documentation focuses on what the tool does for games rather than what it collects from players.
There is no way to get the benefit of deep anti-cheat without some level of system access. The practical question for a player is whether you trust the specific vendor and whether you are willing to keep its software running. Vanguard’s on-boot design means the answer is not just when you play this game – it is a standing decision on that machine.
Compatibility: Steam Deck, Linux, and always-on software
Where you play changes how anti-cheat affects you. Easy Anti-Cheat is the clearest on this: Epic lists Windows, Mac, Linux, and Steam Deck as supported platforms. That Linux and Steam Deck support is significant, because kernel-mode anti-cheat has historically been a pain point for Linux players and handhelds – a driver built for Windows does not simply run on Linux, which is one reason game compatibility on Steam Deck varies by title.
Vanguard’s on-boot behavior is the other practical factor. Because it is usually an on-boot application, disabling it means a restart before you can play a Riot game again, unless your system qualifies for Pre-Check. On a shared or managed machine, that is a real consideration rather than a footnote.
For VAC, the compatibility story is simpler because enforcement is tied to Valve’s own servers. VAC-secured servers are a property of a game’s multiplayer, and the ban follows your account across Steam. The system does not need to stay resident the way Vanguard does; it checks the games you connect to Valve’s servers.
What players should actually do
Most of the practical advice comes straight from Valve’s documentation and applies to any anti-cheat system. Play only on machines you trust; Valve puts this first: use only trusted machines to play on VAC-secured servers. Be cautious with game modifications such as scripts and custom skins, and only download custom content from trusted sources, because hackers sometimes disguise cheats to get other people banned. And understand that reports are not enough on their own – Valve explicitly states that users are not VAC banned based on reports alone.
If you believe a ban was wrong, know the limits of the appeal process. For VAC, there is no appeal, but incorrectly issued bans are automatically removed after investigation, so the path is patience and, if you are certain, reporting the issue through Valve’s channels rather than expecting a manual reversal. For other systems, vendors generally offer their own support and appeal processes – Epic links to an appeal page for Easy Anti-Cheat from its overview page.
Finally, remember the family-sharing rule: if you share your library or machine, the ban can follow the account and the library, not just the person who cheated. The safest posture is to treat your account the way the vendors treat it – as your responsibility.
Limitations of this explainer
This article is built from vendor documentation, and vendor documentation has a known gap: none of these companies fully describe how their detection works, because doing so would help cheat developers. Valve says this outright – it does not disclose the cheats that were detected. Easy Anti-Cheat describes its approach in general terms – heuristics, gameplay analysis, and player reports – without revealing the specifics, and notes that it is continuously refined as cheats evolve. Everything here reflects what the vendors published as of this article’s date; the exact methods will continue to change, and any claim beyond the documentation would be speculation.
The bottom line
Anti-cheat is a trade-off between competitive integrity and the level of access you grant a game on your own machine. Vanguard takes the deepest and most visible approach with a kernel-mode driver and always-on client; Easy Anti-Cheat offers a configurable, cross-platform service; VAC relies on signature detection tied to Valve’s servers with permanent, non-appealable bans. Knowing which model you are agreeing to – and what a ban really means – makes you a more informed player, whether you are deciding what to install, what to play on a Steam Deck, or how to respond to a ban notice.
