VAC vs Riot Vanguard is not a simple strong-versus-weak ranking. Valve and Riot publish different amounts of architectural detail, deploy their systems differently and can combine automated detection with game-specific signals and manual investigation.
This guide uses official documentation and separates confirmed behavior from inference. It does not claim to reveal detection methods that either company keeps private.
What VAC publicly describes
Steam describes VAC as an automated system that identifies known cheat software on computers connected to VAC-secured servers. Valve does not disclose which program caused an individual ban because that information could help cheat developers.
Steam Support's official VAC overview also states that bans are permanent and not manually negotiable.
What Riot publishes about Vanguard
Riot describes Vanguard as a client security and anti-cheat system with a kernel-mode component. For League of Legends, Riot has discussed virtual-machine prevention, device fingerprinting and reducing direct access to client memory.
Read Riot's Vanguard x LoL technical announcement and Vanguard on-demand update for the company's current public explanation.
Startup behavior and system access
A driver that starts with the operating system can observe conditions before the game launches. A service activated on demand has a different lifecycle. Architecture affects privacy and attack-surface discussions, but it does not by itself prove the quality of detection or the absence of false positives.
Users should rely on current official system requirements because both implementations can change. Old screenshots and forum posts may describe a previous release.
Game-specific signals still matter
Anti-cheat is more than scanning files. A developer can change what data the client receives, instrument behavior, investigate reports and introduce targeted signals. Valve's Dota team demonstrated this by adding a hidden data area that ordinary clients would never access.
That documented action is covered in our Dota 2 VAC and delayed-ban evidence guide.
What the public cannot verify
- Complete detection signatures and heuristics.
- The exact timing between detection and enforcement.
- All game-specific server signals.
- A universal false-positive rate.
- Whether a particular private tool will remain undetected.
Because those facts are not public, product sellers cannot honestly guarantee immunity. Use the Dota 2 anti-cheat and account-risk library for the surrounding policy and tooling context.
Privacy and performance tradeoffs
Broader system access creates legitimate privacy and security questions, while narrower deployment does not automatically make an anti-cheat ineffective. Users should read current vendor documentation about data collection, driver lifecycle, uninstall behavior and system requirements instead of inferring them from the word “kernel.”
Performance anecdotes also need controlled evidence. Frame rate, stutter and startup time depend on hardware, drivers, background software and game updates. A single before-and-after post cannot isolate the anti-cheat component without a repeatable setup.
For both systems, the defensible conclusion is limited: official documents explain parts of the architecture and policy, while detection coverage remains intentionally undisclosed. That uncertainty prevents an honest universal ranking.
Enforcement presentation differs too. A VAC record, a game ban, a matchmaking restriction and a Riot account penalty are not interchangeable labels. When reading a report, identify the game, issuer, visible message and date before drawing an architectural conclusion.
This discipline matters because anti-cheat discussions often reverse the logic: one public ban is used to prove that every method is detected, while one unbanned account is used to prove that none are. Neither inference follows from the evidence.
Time also changes the answer. Riot and Valve can revise drivers, services, client telemetry and enforcement workflows without preserving an old article's architecture. Date every claim and revisit the official documentation after significant updates.
Use vendor uninstall instructions when switching games or systems, then verify that the documented service state matches what the client now expects. Keeping obsolete security components installed does not improve protection and makes troubleshooting harder.
