What Is Kernel-Level Anti-Cheat? What It Can See and Why Games Use It

Kernel-level anti-cheat includes software that runs in the privileged part of an operating system. On Windows, that component is usually described as a kernel-mode driver. It is only one part of a wider game-protection system. Riot describes Vanguard as a user-mode client, a kernel-mode driver and a platform component. Activision describes RICOCHET as client and server systems with a PC kernel driver.

The word “kernel” identifies the driver's operating-system privilege, not a promise that a game is free of cheating. It also does not tell you the driver's schedule or data policy. Those details require the named operator's current documentation. The anti-cheat directory links to system-specific pages with that context.

Sources: [1][3][5]

Windows user mode isolates an application in its own virtual address space. According to Microsoft, a user-mode process cannot directly access addresses reserved for the operating system. Kernel-mode code shares an address space with the OS and other kernel drivers. That gives a driver different reach and also a different failure consequence: Microsoft says a crashing kernel driver can crash Windows.

The useful distinction is the trust boundary. A driver can perform checks an ordinary app cannot perform in the same way, but “has kernel access” still describes capability. It is not an inventory of files read or information transmitted by a particular company. In the next sections, the statements about individual systems stay tied to their own publishers.

Sources: [1]

Riot says Vanguard's kernel driver helps its client validate memory and system state and check whether the client was tampered with. Activision says RICOCHET's PC driver helps detect unauthorized programs interacting with protected Call of Duty titles. These are the operators' stated reasons for giving one component privileged access. They do not measure what percentage of cheating the component prevents.

For readers researching Valorant products, the Valorant game comparison groups the listings for that game. The games directory lists the other covered game pages. A claim on a product page is separate from Riot's anti-cheat description. Neither source predicts how a future match or account action will turn out.

Sources: [3][5]

Kernel privilege permits code to operate in the Windows mode reserved for core OS components, with less isolation than a normal application. Microsoft explains that distinction in its driver documentation. It does not describe what Riot, FACEIT or Activision chooses to monitor, keep or transmit. Treating possible access as proof of a named company's actual collection would go beyond the evidence.

Riot's earlier Vanguard architecture article says its driver does not collect or send information about the computer back to Riot. Activision says the RICOCHET driver monitors software interacting with protected Call of Duty games. FACEIT says its anti-cheat software activates and collects game and anti-cheat data only while Counter-Strike is running, despite describing a driver loaded at PC boot. These are the operators' public statements, checked September 29, 2026, and should be read alongside their current privacy notices. CheatsMatch has not tested their software or independently measured collection.

The distinction between “could access” and “says it collects” matters more than a one-word safe or unsafe label. A vendor's architecture page can state a designed limit; it is not an independent audit. Microsoft's description establishes the Windows privilege model; it is not a verdict on a particular anti-cheat.

Sources: [1][3][5][6]

Four anti-cheat operators describe their components differently in public pages checked September 29, 2026. The table records the four operators' disclosures; missing timing details remain unknown from the cited page. It compares published attributes, not detection quality or data-safety outcomes.

Riot's Vanguard page covers the Valorant-specific system and its dated changes. The RICOCHET, FACEIT and BattlEye pages give each operator its own context. A claim about one row should not be carried into another row by analogy.

Sources: [3][4][5][6][7]

Riot Vanguard has two documented driver timing arrangements in the sources checked September 29, 2026: the startup loading described in Riot's earlier architecture article and optional on-demand operation announced June 24, 2026 for PCs meeting Vanguard Pre-Check requirements. In the optional mode, Riot says the driver starts with a Riot game and runs while the player is playing. Eligibility matters, so the new mode cannot be assumed for every Vanguard installation.

FACEIT's support page says its driver loads when the PC boots, while its app must run for a protected Counter-Strike 2 match. Activision says RICOCHET's PC driver starts with a protected Call of Duty title and turns off when the game closes. These are three different published schedules, not one rule for kernel anti-cheat as a category. For BattlEye, the cited About page does not specify a driver start time, so this article leaves it unstated.

Sources: [3][4][5][6][7]

Kernel drivers carry a larger system reliability and security consequence than an isolated application. Microsoft warns that a defect in kernel-mode code can affect other drivers or the operating system, and its driver security checklist asks developers to confirm a kernel driver is needed before choosing that design. That is a general engineering caution, not a finding that one of the anti-cheat products here has a particular vulnerability.

Privacy is a separate question: what data the software observes, transmits and retains. Vendor pages can answer parts of that question, but a kernel-mode label alone cannot. FACEIT points readers to its privacy notice, Riot makes a collection statement in its architecture article, and Activision states its driver monitoring scope. Read those statements with their dates. They are not a substitute for a security audit or a guarantee about every later version.

Sources: [1][2][3][5][6]

Anti-cheat systems can combine PC software and server-side checks. Activision describes client and server systems in RICOCHET, FACEIT names a server-side SDK alongside its app and driver, and BattlEye describes integration on the client and server sides of a game. The precise division is a product decision, so a driver should not stand in for the full system in a comparison.

An account restriction, a launch requirement and a driver design question are different topics. This page covers the driver and its place in a wider system. The by-game anti-cheat table is the next lookup for a specific title; the publisher's page is the source for current account and PC requirements. No architecture diagram or marketing page establishes a universal detection rate.

Sources: [5][6][7]