For as long as there have been video games, there have been players seeking ways to cheat. This longstanding practice has evolved from simple hobbyist tinkering into a vast industry dedicated to selling unfair advantages. With the rise of online competitive gaming as a legitimate profession, hobby-hacking has transformed into a lucrative business, as developers and players alike look for ways to exploit vulnerabilities in games.
As the demand for cheats has surged, video game developers have had to strengthen their anti-cheat teams. These teams are tasked with banning cheaters, neutralizing the software they use, and taking action against cheat developers. Recently, many companies have adopted controversial anti-cheat systems that operate at the kernel level, granting them extensive privileges within the operating system. This allows these systems to monitor virtually all activities on the machine running the game.
One of the most well-known kernel-level anti-cheat systems is Vanguard, created by Riot Games, the developer behind popular titles like League of Legends and Valorant. Vanguard effectively “forces cheats to be visible,” according to Phillip Koskinas, the director of anti-cheat at Riot, who describes his role as “an anti-cheat artisan” dedicated to removing cheaters from the gaming experience. Thanks to Vanguard and Koskinas's team, Riot bans thousands of cheaters in Valorant every day. As of early 2025, the percentage of ranked games with cheaters has dropped to under 1% globally, a testament to Riot's effective anti-cheat measures.
In an interview with TechCrunch, Koskinas outlined various strategies employed by Riot’s anti-cheat team. These include leveraging security features built into the Windows operating system, using hardware fingerprinting to track repeat offenders, infiltrating cheat communities, and employing psychological tactics to discredit cheaters. Koskinas emphasized that their approach goes beyond mere technology; understanding cheaters’ behaviors is crucial to their strategy.
Vanguard capitalizes on several security features integral to Windows. Koskinas explained that the anti-cheat software enforces essential security measures, such as Trusted Platform Module and Secure Boot. These technologies ensure that the computer has not been tampered with or infected with malware. Vanguard also checks that all hardware drivers are up to date to identify any additional hardware that could facilitate cheating. By preventing cheats from executing code in the kernel’s memory, Vanguard creates a secure environment for fair play.
The anti-cheat team also employs a “reconnaissance arm” dedicated to gathering intelligence on cheat developers and their products. This involves infiltrating cheat communities using undercover identities. Koskinas noted that they sometimes provide anti-cheat information to build credibility, which helps them gain access to cheat development discussions. By understanding the cheat landscape, they can better counteract emerging threats.
Some cheat developers attempt to evade detection by marketing their products as high-end or “premium” cheats, which can cost thousands of dollars and are sold to a select few customers. These cheats are designed to be harder to detect and often come with the promise of remaining undetected. Koskinas explained that these developers aim to sell the reputation of being undetected, making their products more enticing to potential buyers.
Riot’s anti-cheat team employs tactics to publicly discredit cheat developers, such as banning all their players or leaking incriminating screenshots. Koskinas asserted, “We can just make them look like fools.” However, they also recognize the importance of maintaining a balance; by allowing some level of cheating, they can slow the development of better cheats. Koskinas explained that if they banned every player immediately, the cheaters would simply switch to different cheats until they found one that wasn’t detected.
Cheaters generally fall into two categories. The majority engage in “rage cheating,” using easy-to-detect tools that Koskinas humorously refers to as “download-a-ban.” These cheaters tend to be younger and often engage in cheating behavior as a way to assert power in the game. The second category consists of users of premium cheats, which are more sophisticated and harder to detect. These cheats often rely on hardware manipulation, such as direct memory access (DMA) attacks, allowing players to see through walls and gain significant advantages.
As technology advances, the potential for AI to be used in cheating becomes a growing concern for Koskinas. He warned that AI could learn to mimic human inputs, making it increasingly difficult to detect cheating behavior. Despite these challenges, Riot has no plans to abandon its kernel-level anti-cheat approach for Valorant, as doing so would make it simpler for cheaters to exploit the system.
In a bid for transparency, Koskinas has committed to sharing more about Riot’s anti-cheat efforts, including publishing blog posts and engaging with the media. He believes that players deserve to know how the company utilizes its extensive privileges to ensure fair play. “The best thing we can do in asking for that level of access is being as transparent as possible,” Koskinas concluded.
