What actually happens on your PC between the moment you double-click a game icon and the moment you’re in a lobby? For most players, that gap is invisible. But the anti-cheat system sitting in that gap shapes everything from how long your PC takes to boot to whether your favorite game runs on Linux at all. Three names dominate the conversation: Easy Anti-Cheat (EAC), BattlEye, and Riot’s Vanguard. They are not interchangeable, and the differences are not academic. They change daily workflows for players, modders, streamers, and studios.
This piece explains how each system behaves, where friction appears in practice, and what to expect as the situation shifts toward 2027.
The Three Contenders at a Glance
Before diving into workflows, it helps to know who owns what, because ownership drives design philosophy.
| System | Owner | Typical Load Behavior | Platform Support | Third-Party SDK |
|---|---|---|---|---|
| Easy Anti-Cheat | Epic Games (acquired Kamu in 2018) | Loads with the protected game | Windows, plus documented Linux/Proton paths | Yes, widely licensed |
| BattlEye | BattlEye Innovations (independent, Germany) | Loads with the protected game | Windows, plus documented Linux/Proton paths | Yes, widely licensed |
| Vanguard | Riot Games (in-house) | Kernel driver loads at system boot | Windows only | No, Riot titles only |
That table is the whole article in miniature. Everything else is the practical fallout.
Ownership Shapes the Workflow
EAC belongs to Epic Games, which bought Kamu, the company behind Easy Anti-Cheat, back in 2018. That matters because Epic also runs a storefront and a game engine. EAC is licensed broadly to third-party studios, so it shows up in everything from indie multiplayer titles to massive shooters.
BattlEye is the odd one out: an independent German company with no publisher parent. That independence shows in its posture. It is sold as a service to studios and stays out of platform politics.
Vanguard is Riot’s own tool, built for Riot’s own games. It is not a product you can license. That single fact explains most of its behavioral differences. Riot can afford to be aggressive because it only has to satisfy itself and its own player base.
Boot-Time vs Launch-Time: The Biggest Practical Split
Here is where players feel the difference most.
Vanguard’s kernel-mode driver, vgk.sys, loads at system startup. Not when you launch Valorant. At boot. The driver sits resident on your machine whether you’re playing or not. Riot has publicly defended this design, arguing that boot-time loading closes the window where cheats could load before the anti-cheat does.
EAC and BattlEye generally take a launch-time approach. Their components spin up when the protected game starts and wind down when it closes. There are kernel-level components involved, but the persistent-at-boot behavior is the Vanguard signature.
Why does this matter in practice? A few concrete ways:
- Boot time. A resident kernel driver adds a small but measurable slice to startup. On older hardware, it’s noticeable.
- Conflict surface. Any always-on kernel driver can interact badly with other low-level software: RGB utilities, fan control tools, some VPN clients, and virtualization software.
- Mental overhead. With Vanguard, “is anti-cheat running?” is always yes. With EAC and BattlEye, it’s “only when the game is open.”
If you’ve ever troubleshot a Windows machine where something felt off at startup, you know how annoying a persistent low-level component can be. The same troubleshooting instincts apply: check what loads at boot, and understand why.
Kernel Mode, Explained Without the Jargon
A kernel-mode driver runs with the highest privileges on the operating system, at what security researchers call ring 0. Code at that level can see and do nearly anything. A user-mode program runs in a sandboxed layer with limited access. (User mode and kernel mode (Microsoft Learn))
Anti-cheat vendors push toward kernel mode because cheats themselves operate at low levels. To catch a cheat reading game memory, the anti-cheat often needs comparable access. That’s the honest trade: more detection power, more trust required. (Anti-cheat software (Wikipedia overview))
The workflow consequence is trust management. Players have to decide whether they trust a given vendor’s driver on their machine. Studios have to decide whether shipping a kernel driver is worth the support burden. Neither decision is trivial, and both get harder as the number of always-on drivers grows.
Linux, Steam Deck, and the Compatibility Question
Vanguard is Windows-only. Riot has stated it won’t support Linux or Steam Deck for Vanguard-protected titles. For a certain slice of players, that’s a hard stop: if you game on Linux, you simply cannot play those titles.
EAC and BattlEye both have documented Linux and Proton support paths used by Steam titles. Not every game enables them, but the option exists. That flexibility is a real workflow difference for handheld owners and Linux desktop gamers.
The practical takeaway: before buying a multiplayer game for a Steam Deck or Linux machine, check the anti-cheat in addition to the system requirements. A game can list “Steam Deck Playable” and still be blocked by its anti-cheat layer. This mistake is common, and five minutes of research avoids it.
The Studio Side: SDK Integration and Support Load
For developers, the choice often comes down to integration effort.
EAC and BattlEye both offer developer SDKs and server-side integration. Game servers call the anti-cheat backend to validate sessions. That means a studio can bolt either system onto an existing multiplayer stack without building detection from scratch. Both vendors handle ban waves, signature updates, and the unglamorous backend work.
Vanguard isn’t available as a third-party SDK. It’s Riot’s in-house system for Riot titles. A studio cannot license it. So for anyone outside Riot, the real comparison is EAC vs BattlEye, and Vanguard is the reference point for “what aggressive looks like.”
If you’re evaluating tools for a development workflow more broadly, the same principle applies across software: match the tool to the job, not to the hype. That’s true whether you’re picking an anti-cheat or deciding between note apps, as this comparison of Obsidian vs Logseq local-first notes by workflow shows.
False Positives, Ban Waves, and Player Trust
All three systems generate false positives occasionally, and all three run ban waves to catch cheaters in batches. The workflow difference is in how appeals and transparency are handled.
Vanguard’s aggressive posture means fewer cheaters but louder complaints when something goes wrong, because the driver is always present and any conflict feels personal. EAC and BattlEye, being licensed products, tend to be more conservative because a false ban damages a vendor’s relationship with many studios at once.
For players, the practical advice is simple: keep your machine clean of overlay tools and memory-editing utilities you don’t fully understand. Most false positives trace back to software that behaves like a cheat even when it isn’t one.
Privacy and Data Handling: Read the Policy, Not the Vibe
It’s tempting to declare one vendor “more private” than another. Resist that. Each vendor publishes its own privacy policy, and the details change over time. The honest comparison requires reading the specific policy text and noting the date.
What you can say confidently: a boot-time kernel driver has a larger observation window than a launch-time one, simply because it runs more often. Whether that window is used depends entirely on what the software actually collects, which is a policy question, not an architectural one.
What Changes by 2027
Here’s where honesty matters. Claims about 2027 behavior are speculative unless tied to a vendor roadmap or a platform policy announcement. A few things to watch:
- Windows kernel driver policy. Microsoft’s security posture around kernel drivers could shift, and any change would affect all three systems. Watch official developer documentation rather than forum rumor.
- Platform expansion. Whether Vanguard ever supports Linux is a Riot decision, not a technical inevitability.
- Architecture drift. EAC and BattlEye could add more persistent components; Vanguard could soften its boot behavior. Nothing is permanent.
The safe framing for 2027: expect the boot-time vs launch-time split to remain the defining workflow difference, and expect platform policy to be the wild card.
Practical Tips That Actually Work
A few things that hold up regardless of which system you’re dealing with:
- Audit your startup list. Know what loads at boot. On Windows, Task Manager’s startup tab is the fastest check.
- Check anti-cheat before buying. Especially for Steam Deck and Linux.
- Keep overlays minimal. Fewer hooks into game processes means fewer conflicts.
- Don’t run virtualization and aggressive anti-cheat simultaneously unless you’ve confirmed compatibility.
- Document your setup. When something breaks, knowing what changed saves hours.
If you’re the type who tunes a machine for consistency, you probably already think this way. The same mindset shows up in niche hobbies, like the keyboard foam mod sound differences that actually change with materials, where small physical choices produce outsized results.
Conclusion
EAC, BattlEye, and Vanguard are not three flavors of the same thing. They represent three philosophies: licensed and flexible, independent and steady, and in-house and aggressive. The workflow differences flow directly from those philosophies, from whether a driver loads at boot to whether Linux players get through the door at all.
For players, the practical move is to know which system guards the games you care about and plan around it. For studios, the choice between EAC and BattlEye is a real integration decision, while Vanguard is a benchmark rather than an option. And for everyone, what happens in 2027 is worth watching, but only through official channels. Architecture claims age fast; verified documentation doesn’t.
Frequently Asked Questions
Does Vanguard really run all the time, even when I’m not playing?
Yes. Vanguard’s kernel driver loads at system startup, so it’s resident whether or not a Riot game is open. That’s the core design choice that separates it from launch-time systems like EAC and BattlEye.
Can I play Vanguard-protected games on Linux or Steam Deck?
No. Vanguard is Windows-only, and Riot has stated it won’t support Linux or Steam Deck for Vanguard-protected titles. EAC and BattlEye both have documented Linux and Proton paths, though individual games must enable them.
Is kernel-mode anti-cheat dangerous?
” Dangerous” is the wrong frame. Kernel-mode drivers run with the highest privileges, so they carry more responsibility than user-mode software. The risk depends on the vendor’s security practices and your trust in them, not on the concept alone.
Can any studio license Vanguard?
No. Vanguard is Riot’s in-house system used only for Riot titles. Studios choosing an anti-cheat pick between EAC and BattlEye, both of which offer SDKs and server-side integration.
Why do false positives happen?
Anti-cheat software watches for behavior that resembles cheating, and some legitimate tools, like overlays or memory utilities, look similar. Keeping your machine free of unfamiliar low-level tools reduces the odds considerably.
Will these systems work differently by 2027?
Possibly. Platform policy changes, especially around Windows kernel drivers, could reshape all three. Treat 2027 predictions as speculative unless they come from official vendor or platform documentation.
The safest bet is to verify against vendor documentation each time you set up a new machine, rather than relying on what was true a year ago. Anti-cheat architecture is a moving target, and the players who stay ahead of it are the ones who check the source instead of the rumor mill.
That habit pays off across every title you install. Before you troubleshoot a stutter, a crash, or a blocked launch, confirm which anti-cheat is actually in play and whether it loads at boot or at launch. Most support threads would be shorter if that step came first. Vendors publish compatibility notes and policy updates; read them directly, and re-check after major Windows updates, since driver-level behavior is exactly what those updates can disturb. The workflow differences between EAC, BattlEye, and Vanguard are stable enough to plan around, but the details are not frozen. Treat documentation as the source of truth, and your setup will keep working long after the 2027 predictions fade. (Use claude writing practical workflow that actually works)
