Windows 11 Anti-Cheat Compared: Vanguard On-Demand, EAC Errors and BattlEye Requirements

To understand where the real differences lie in late 2026, PC gamers and system administrators have to separate broad community assumptions from verified vendor policies. What does your anti-cheat actually demand from your motherboard, when does its driver really load, and how are native Windows 11 security features changing the bargain?

What Kernel-Level Access Actually Means on Windows​

In the hierarchy of the Windows operating system, normal applications—your web browser, your Discord client, and the game executable itself—run in "user mode" (Ring 3). User-mode programs can only see the memory spaces Windows explicitly permits them to touch. Cheat developers realized years ago that if they wrote their cheat tools as "kernel mode" (Ring 0) drivers, their software could sit underneath the operating system’s standard guardrails, modifying game memory while remaining completely invisible to any user-mode anti-cheat trying to spot them.

That arms race is why major anti-cheat systems moved into the kernel themselves. However, operating at Ring 0 is not a monolithic concept. The real-world impact on a Windows PC depends heavily on two factors: driver load timing (whether the driver runs at Windows boot or only when a game launches) and hardware security mandates (whether the anti-cheat relies on its own persistent surveillance or offloads that trust to your CPU and motherboard).

Riot Vanguard and the June 2026 "On-Demand" Shift​

For years, Riot Vanguard—the proprietary, in-house security system protecting VALORANT and League of Legends —was famous for a strict, non-negotiable posture: its kernel driver loaded the moment Windows booted up and stayed resident in memory whether you were playing a Riot title or balancing a spreadsheet.

According to Riot Games' official engineering documentation, this boot-start design was built to solve the "Who Loads First?" problem. If an anti-cheat driver only loads when you click "Play," a cheat user can load a vulnerable third-party driver (an attack style known as Bring Your Own Vulnerable Driver, or BYOVD) right after booting Windows, map a hidden cheat into kernel memory, and unload the vulnerable driver before the anti-cheat ever wakes up. By starting at boot and maintaining a local blocklist of known-vulnerable drivers, Vanguard ensured the kernel perimeter hadn't been breached prior to game launch.

On June 24, 2026, however, Riot fundamentally altered that bargain by introducing Vanguard On-Demand. For eligible systems, Vanguard’s kernel driver no longer needs to launch at Windows startup; instead, it can start only when a Riot game launches and shut down once the session ends, reclaiming those infamous system tray pixels.

Here is the catch: Vanguard On-Demand is an optional mode gated behind a strict hardware and OS verification gate called Vanguard Pre-Check. According to Riot Games Support, a PC must meet six specific Windows security requirements to qualify for On-Demand mode:

• Windows 11 version 25H2 or newer
• UEFI Secure Boot enabled
• TPM 2.0 (Trusted Platform Module)
• IOMMU (Input-Output Memory Management Unit) enabled
• Virtualization-Based Security (VBS) active
• Hypervisor-Protected Code Integrity (HVCI), commonly known in Windows settings as Memory Integrity

Why does turning on these six Windows 11 features allow Riot to stop running its driver at boot? In its June 2026 technical breakdown, Riot credited Microsoft’s implementation of the Runtime Driver Attestation Report. Instead of Vanguard needing to stand guard at boot to watch every driver that loads, Windows 11 (on 25H2 and newer) can measure every on-demand driver into the TPM 2.0 cryptoprocessor—extending a cumulative, tamper-resistant cryptographic hash of every driver loaded since boot. When you launch a Riot game, Vanguard can check that PII-free attestation log to verify no vulnerable drivers were slipped into the kernel earlier in the session.

Simultaneously, the other Pre-Check pillars close off hardware and hypervisor loopholes:

• VBS and HVCI operate at a hypervisor privilege level (Ring -1) below the OS kernel itself, cryptographically verifying kernel memory pages before execution and automatically enforcing Microsoft’s Vulnerable Driver Blocklist.
• IOMMU forces PCIe hardware devices to use virtual memory addresses mapped through a translation table rather than reading physical RAM directly, allowing Vanguard to mark game memory unreadable and block Direct Memory Access (DMA) cheat cards.
• TPM 2.0 provides both the secure storage for boot measurements and a factory-burned Endorsement Key for hardware identity. Notably, Riot states that while either a discrete motherboard TPM (dTPM) or a CPU firmware TPM (fTPM) satisfies the standard Pre-Check, accounts placed under special "Vanguard Restrictions" for suspicious behavior must specifically use an fTPM, preventing cheaters from bypassing a hardware ban with a cheap, swappable discrete TPM module.

At the time of the rollout, Riot noted that roughly 35% of its player base on modern "Secured-core" PCs already met all six Pre-Check requirements out of the box. For everyone else, failing the Pre-Check does not lock you out of VALORANT—it simply means Vanguard remains on its traditional boot-start behavior until you opt in and meet the hardware baseline.

Easy Anti-Cheat: Middleware Flexibility Meets Windows 11 Stack Protection​

Unlike Vanguard, which is built exclusively for Riot’s own titles, Epic Games’ Easy Anti-Cheat (EAC) is third-party middleware integrated into Epic Online Services and licensed across a massive variety of PC games, including Epic’s own Fortnite.

In its October 14, 2026 engineering update, Epic Games explicitly confirmed how its Windows architecture behaves: on Windows, EAC relies heavily on a kernel driver to protect games, and that driver is not always on—it starts when a protected game launches and stops when the player exits. Because EAC is licensed middleware, however, individual game studios configure how they deploy it and which enforcement policies they use.

That kernel footprint can occasionally collide with Windows 11’s own security hardening. According to Epic Games Support documentation for EAC driver error 1275, enabling Windows 11’s Kernel-mode Hardware-enforced Stack Protection can prevent certain EAC-protected games—specifically including Fortnite and Rocket League—from launching properly. Because certain EAC drivers are incompatible with that specific Windows 11 memory protection feature, Epic notes that affected players may have to disable Kernel-mode Hardware-enforced Stack Protection to resolve Error 1275, while explicitly cautioning users that turning off the Windows setting reduces system security and increases vulnerability to malware.

It is a fascinating contrast in the 2026 Windows security ecosystem: while Riot’s Vanguard leans on HVCI and VBS to reduce its boot-time footprint, certain deployments of EAC on Windows 11 can still bump heads with Microsoft’s hardware-enforced stack protection.

Epic’s October 2026 Pivot: EAC Linux v2 Closes the TPM Gap​

While Shattered.io and other industry observers have traditionally contrasted EAC’s lighter baseline against Vanguard’s strict hardware checks, Epic Games is rapidly closing that hardware-security gap on another front. On October 14, 2026, Epic announced Easy Anti-Cheat Linux v2, an overhaul designed to bring Linux anti-cheat protection much closer to parity with Windows—and eventually bring Fortnite to Linux.

Rather than loading a kernel module on Linux, EAC Linux v2 uses an on-demand systemd service and eBPF (Extended Berkeley Packet Filter) programs alongside Linux Security Module hooks. Crucially, to ensure the underlying operating system hasn't been tampered with, EAC Linux v2 enforces an aggressive hardware and boot-chain checklist that looks remarkably similar to Vanguard’s Windows 11 Pre-Check:

• TPM 2.0 enabled in BIOS
• UEFI Secure Boot using a curated list of well-known distribution signing keys (such as Canonical, Fedora, Universal Blue, Debian, and Microsoft UEFI CA)
• Measured Boot via bootloaders like systemd-boot or GRUB to log boot measurements into TPM Platform Configuration Registers (PCRs)
• IOMMU enabled with passthrough disabled (on non-handheld devices) to block DMA cheat hardware
• Signed Kernel and Kernel Modules, Kernel Lockdown Integrity Mode, and Kexec Disabled at boot

Epic noted that because the current Steam Deck hardware and OS configuration does not yet support all of these required features, EAC Linux v2 does not currently support the Steam Deck, though Epic is in active discussions with Valve. For developers, EAC Linux v2 will be an option alongside the older, more permissive Proton/Wine EAC implementation after Epic pilots the v2 architecture in Fortnite.

BattlEye and the Challenge of Unverified Benchmarks​

The third major pillar in competitive PC gaming is BattlEye, the long-running middleware protecting tactical shooters and survival titles like PUBG, Rainbow Six Siege, and Escape from Tarkov. In community comparisons and reporting from outlets like Shattered.io, BattlEye is frequently praised for operating as a session-bound driver that loads alongside the game without mandating a system-wide Windows 11 TPM 2.0 or Secure Boot gate of its own.

Here, however, veteran IT admins and savvy players need to keep their skepticism sharp. While Shattered.io points to third-party tracking databases and testing notes to contrast BattlEye’s delayed ban waves, driver timing, and conflicts against EAC and Vanguard, neither BattlEye Innovations, Epic Games, nor Riot Games publishes open, standardized telemetry that allows for an apples-to-apples laboratory comparison.

In fact, as Shattered.io’s reporting acknowledges, there is no independently audited benchmark measuring comparative detection accuracy, false-positive rates, or exact CPU and frame-rate overhead across identical cheat samples for Vanguard, EAC, and BattlEye. Anti-cheat vendors guard their internal detection logic and telemetry for an obvious reason: publishing exact detection triggers or performance thresholds hands commercial cheat developers a blueprint for evasion.

Comparing the Documented Baselines​

When we strip away unverified lore and focus strictly on documented architecture and vendor policies in late 2026, the three platforms break down along clear structural lines:

Practical Troubleshooting: Checking Your Rig and Fixing Driver Friction​

If you are a Windows 11 user trying to get your system ready for Vanguard On-Demand, or troubleshooting an Easy Anti-Cheat launch failure, you don't need to guess at your BIOS configuration.

1. How to Verify Vanguard Pre-Check Eligibility​

While Shattered.io suggests querying Get-Tpm, Confirm-SecureBootUEFI, and msinfo32 in PowerShell to inspect your hardware baseline, those built-in Windows checks only show piece-meal status and do not confirm all six Pre-Check requirements (such as IOMMU remapping or Windows 11 25H2 driver attestation).

• Use Riot’s Official Tool: Riot Games Support directs players to use the VGTray utility sitting in the Windows system tray. Opening VGTray and selecting the Vanguard Pre-Check verification option will explicitly tell you if your PC qualifies for On-Demand mode and flag whichever specific requirement (Windows 11 version 25H2, Secure Boot, TPM 2.0, IOMMU, VBS, or HVCI) still needs attention in your UEFI/BIOS or Windows Security settings.

2. Resolving EAC Driver Error 1275 on Windows 11​

If Fortnite, Rocket League, or another EAC-protected title fails to launch on Windows 11 with Error 1275 (Driver load error):

• Check whether Kernel-mode Hardware-enforced Stack Protection is enabled under Windows Security > Device security > Core isolation details.
• Keep Epic’s security warning in mind: disabling that stack protection setting can allow older or conflicting EAC drivers to load, but it removes a layer of Windows 11 defense against memory attacks outside of gaming.

3. Repairing a Corrupted Easy Anti-Cheat Installation (Fortnite Example)​

If an EAC service fails to initialize after switching games or updating Windows, Epic Games Support advises against dragging raw executables around your desktop. Instead, for Fortnite on Windows 10 or Windows 11:

1. Close the game launcher and restart Windows to ensure no background processes are locked.
2. Open File Explorer and navigate to C:\Program Files (x86)\EasyAntiCheat_EOS (or the EasyAntiCheat_EOS folder inside your custom game installation directory).
3. Right-click EasyAntiCheat_EOS_Setup.exe and select Create Shortcut (on Windows 11, click Show more options first, then Create Shortcut), placing it on your desktop.
4. Right-click the new desktop shortcut, open Properties, and in the Target field, append install prod-fn after the quotation marks so it reads:
   "C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe" install prod-fn
5. Click Apply and OK, then double-click the shortcut to silently repair the service before relaunching the Epic Games Launcher.

The Bottom Line for Windows Gamers​

The story of PC anti-cheat in 2026 isn't about one driver being magically "safe" while another is "spyware". It is about a fundamental architectural handoff. Rather than acting as permanent, boot-time security guards that police the Windows kernel themselves, modern anti-cheat platforms like Riot Vanguard—and now Epic’s EAC Linux v2—are increasingly demanding that the operating system and motherboard hardware prove their own integrity first. For Windows 11 users on modern hardware, enabling TPM 2.0, Secure Boot, IOMMU, and HVCI doesn't just harden your PC against everyday malware; as of 2026, it is also the ticket to getting boot-time anti-cheat drivers out of your Windows startup sequence.