Every time a competitive shooter launches, it installs an invisible bouncer that runs deeper inside Windows than the game itself. Easy Anti-Cheat, BattlEye, and Riot Vanguard are the three programs deciding who gets to play Fortnite, Escape from Tarkov, and Valorant, and increasingly, who gets locked out of PC gaming on Linux and Steam Deck entirely.
The stakes got harder to ignore in December 2025, when a years-old Easy Anti-Cheat flaw was formally catalogued as CVE-2021-47739, a CVSS 8.5 local privilege escalation bug that sat in public exploit databases long before it got an official tracking number. Riot’s Vanguard driver still loads before Windows finishes booting on most installs. Academic researchers keep flagging it alongside FACEIT’s client as rootkit-adjacent software. And the community tracker Are We Anti-Cheat Yet now lists 642 of 1,166 games as broken on Linux, mostly because of decisions these three systems make.
This comparison breaks down how easy anti cheat, BattlEye, and Riot Vanguard actually work, which games use each one, what each does inside your kernel, and which one deserves your trust in 2026, using verified data instead of forum folklore. We’ll also look at where these three fit against the rest of the anti-cheat market, why studios pick one over another, and what actually changes on your PC when you move between them.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What “Kernel-Level” Anti-Cheat Actually Means
Windows separates code into privilege rings. Ring 3 is where your game, your browser, and almost every app you run actually executes, sandboxed away from the rest of the operating system. Ring 0 is the kernel: the layer that talks directly to your hardware, manages memory for every process, and can see (and alter) essentially anything running on the machine. A driver in Ring 0 does not ask permission from other software. It IS the permission system.
Cheat developers figured out years ago that if their code also runs in Ring 0, it can hide from an anti-cheat system confined to Ring 3. So publishers pushed their anti-cheat into the kernel too, on the theory that only kernel-level code can reliably see kernel-level cheats. Easy Anti-Cheat, BattlEye, and Riot Vanguard all operate at kernel level today, which is precisely why each one generates the same recurring debate: a program built to catch cheaters also has the technical capability to read process memory, monitor every driver on your system, and, in Vanguard’s case, launch before your antivirus does.
That shared architecture is also where the three systems stop resembling each other. Epic, BattlEye GmbH, and Riot Games made different calls on when their drivers load, how aggressively they scan, whether developers get a choice, and whether Linux users get a path in at all. Those differences are the whole story of this comparison.
Easy Anti-Cheat (EAC): Epic’s Free Middleware
Easy Anti-Cheat started life as a smaller, independent product before Epic Games acquired it in October 2018 and folded it into Epic Online Services. That acquisition changed its trajectory: EAC became free for any developer to integrate, which is the single biggest reason it now protects more games than BattlEye and Vanguard combined.
Unlike Vanguard, EAC gives developers a choice between kernel-mode and user-mode deployment, so the exact level of access varies title by title. Its detection approach layers signature scanning against known cheat software, behavioral analysis that watches for suspicious in-game patterns, and driver monitoring, with signature updates typically shipping on a weekly cadence. When EAC does catch someone, the consequences travel: bans are enforced across every EAC-protected game a player owns through a shared hardware ID system, so a violation in one title can lock a cheater out of dozens of others.
Easy anti cheat now runs under more than 100 titles, including Fortnite, Rust, Sea of Thieves, Squad, War Thunder, Dead by Daylight, Halo: The Master Chief Collection, SMITE, Back 4 Blood, and ARC Raiders. That scale is EAC’s real advantage: it is the only one of the three that most PC gamers will run into constantly, across wildly different genres, on both Windows and, when a developer opts in, Linux.
Scale comes with baggage. In December 2025, CVE-2021-47739 was formally disclosed: a CVSS 8.5 unquoted service path vulnerability in EAC 4.0 that allows a local, unprivileged user to escalate to LocalSystem privileges. The flaw was originally found by Zero Science Lab back in 2021 and tracked as ZSL-2021-5652, but it did not receive an official CVE identifier until years later. It requires an attacker to already have local access to the machine, which limits real-world risk, but the multi-year gap between discovery and formal disclosure is a legitimate mark against EAC’s patch transparency.
BattlEye: The Oldest Anti-Cheat Still Standing
BattlEye predates both of its rivals by well over a decade. Founded in 2004 and still operated by BattlEye Innovations (BattlEye GmbH), it has outlasted several anti-cheat competitors that launched and folded in the years since. That longevity shows in how conservatively it is engineered: BattlEye’s kernel driver loads only while a protected game is actually running and unloads when the game exits, rather than sitting resident from boot the way Vanguard does.
Its detection model leans on deep memory scanning and behavioral heuristics rather than the boot-time driver surveillance Vanguard relies on. BattlEye also treats bans as a per-publisher matter. Getting caught cheating in Escape from Tarkov does not touch your Rainbow Six Siege account, because each studio manages its own BattlEye-enforced ban list rather than sharing one global blacklist. Ban decisions typically arrive in batched waves rather than instantly, which reduces false-positive whiplash for legitimate players who trip a flag during a lag spike or a driver update.
BattlEye protects roughly 15 to 20 major titles, a far smaller footprint than EAC but concentrated in exactly the genres where cheating is most damaging: extraction shooters and military sims. Escape from Tarkov, DayZ, Rainbow Six Siege, PUBG, Arma 3, ARK, and Destiny 2 all run on BattlEye. BattlEye has also worked directly with Valve to enable Linux and Proton compatibility on an opt-in basis, the same model EAC uses. That collaboration explains why ARK and DayZ run fine on Steam Deck while PUBG, also a BattlEye title, remains broken on Linux simply because Krafton has not flipped the switch on its end.
Riot Vanguard: The Strictest of the Three
Riot Vanguard is the youngest of the three and, by design, the most invasive. Riot Games deployed it in 2020 alongside Valorant’s launch, then extended it to League of Legends in 2023, a rollout that drew backlash from players who had run a 15-year-old game without a kernel driver and suddenly needed one to keep playing. Vanguard remains proprietary to Riot. It is not licensed to outside developers the way EAC and BattlEye are, so it protects exactly two games and nothing else.
The architectural choice that defines Vanguard is boot-time loading. Its driver, vgk.sys, loads before most of Windows finishes initializing, by default, which means Vanguard is watching every other driver that attempts to load into the system from the moment you power on your PC, not just while Valorant is open. Riot’s reasoning is that cheat developers who load malicious drivers before the anti-cheat starts can otherwise slip past detection entirely. In 2025, following years of privacy criticism, Riot introduced an opt-in “on-demand” mode that disables boot-time loading for players willing to trade some protection for convenience. Reported adoption sits around Riot has never published exact Linux support percentages for League of Legends, and as of April 2026, the game is fully blocked on Linux due to Vanguard, making any “35%” figure unverified[1][2].
Vanguard also maintains a system-wide blocklist of known-vulnerable third-party drivers, blocking them from loading at all, even outside of Valorant or League of Legends, on the logic that a vulnerable driver anywhere on the system is a potential entry point for a cheat. It is consistently cited by security researchers as the hardest of the three to bypass. That same aggressiveness is why independent research has grouped Vanguard with FACEIT’s anti-cheat client as exhibiting rootkit-like characteristics, a classification neither EAC nor BattlEye received. Vanguard also has zero Linux or SteamOS support, and Riot has been explicit that this is a deliberate block, not a technical limitation waiting to be fixed.
Easy Anti-Cheat vs BattlEye vs Vanguard: Full Specs Comparison
| Category | Easy Anti-Cheat | BattlEye | Riot Vanguard |
|---|---|---|---|
| Owner/operator | Epic Games | BattlEye GmbH | Riot Games |
| Founded / deployed | ~2015 (Epic-owned since 2018) | 2004 | 2020 (Valorant), 2023 (LoL) |
| Kernel access | Kernel or user-mode, developer’s choice | Kernel-level (Ring 0) | Kernel-level (Ring 0) |
| Boot-time loading | No, loads with the game | No, loads with the game | Yes by default; opt-in on-demand mode since 2025 |
| Detection method | Signature scanning + behavioral analysis | Deep memory scanning + heuristics | Boot-time monitoring + driver blocklist + kernel scanning |
| Games protected | 100+ titles | ~15-20 major titles | 2 titles only |
| Notable games | Fortnite, Rust, Sea of Thieves | Escape from Tarkov, PUBG, R6 Siege | Valorant, League of Legends |
| Ban model | Cross-game HWID bans | Per-publisher ban waves | HWID + account bans |
| Linux/SteamOS support | Opt-in via Proton | Opt-in via Proton | Blocked entirely |
| Cost to developers | Free (Epic Online Services) | Negotiated licensing | Not available externally |
| Available to third-party studios | Yes | Yes | No, Riot titles only |
| 2025-2026 security note | CVE-2021-47739 (CVSS 8.5) disclosed Dec 2025 | Periodic false-positive reports | Ring 0 driver flaws probed by researchers; on-demand mode added |
Laid out side by side, the pattern is obvious: EAC optimizes for reach and developer flexibility, BattlEye optimizes for a middle ground it has held since 2004, and Vanguard optimizes for raw detection power at the cost of everything else, including your boot sequence and your Linux compatibility. None of the three is objectively “better” outside of a specific use case, which is exactly why the rest of this comparison exists.
Which Games Use Which Anti-Cheat
The clearest way to understand these three systems is through the games they actually protect. Each publisher’s choice of anti-cheat says as much about its priorities as any marketing statement.
| Game | Anti-cheat | Genre | Linux/Steam Deck status |
|---|---|---|---|
| Fortnite | Easy Anti-Cheat | Battle royale | Broken (Epic disabled Linux support) |
| Rust | Easy Anti-Cheat | Survival | Supported |
| Sea of Thieves | Easy Anti-Cheat | Adventure/multiplayer | Running with caveats |
| Escape from Tarkov | BattlEye | Extraction shooter | Broken |
| DayZ | BattlEye | Survival | Supported |
| ARK: Survival Ascended | BattlEye | Survival | Supported |
| PUBG | BattlEye | Battle royale | Broken (publisher has not enabled it) |
| Rainbow Six Siege | BattlEye | Tactical shooter | Broken |
| Valorant | Riot Vanguard | Tactical shooter | Denied (explicitly blocked) |
| League of Legends | Riot Vanguard | MOBA | Denied (explicitly blocked) |
A few of these are worth calling out individually. Escape from Tarkov is arguably BattlEye’s highest-stakes deployment: it’s a game built entirely around permanent item loss, so a single undetected cheater can erase hours of another player’s progress in one raid, which is why Battlestate Games leans hard on BattlEye’s memory scanning. Valorant remains the reference case for kernel-level controversy in general. It was one of the first mainstream games to require a boot-time kernel driver just to launch the client, and it is still the example most gamers picture when they hear the phrase “kernel-level anti-cheat,” even though BattlEye and EAC also run at kernel level in most of their deployments.
League of Legends is the more interesting migration story. Riot added Vanguard to a game that had shipped without any kernel-level protection for well over a decade, and did so specifically to close a loophole where cheaters were using LoL as a soft target to test tools before deploying them in Valorant. PUBG and Rainbow Six Siege illustrate a separate point entirely: both run on BattlEye, a system that does support Linux elsewhere, yet both remain broken on Steam Deck because Krafton and Ubisoft, not BattlEye itself, have not opted in. That distinction, between what an anti-cheat technically supports and what a publisher actually enables, matters more than most players realize.
Where FACEIT, RICOCHET, and Other Anti-Cheat Systems Fit In
Easy Anti-Cheat, BattlEye, and Riot Vanguard dominate the conversation, but they aren’t the only kernel-level systems running on PC gaming rigs in 2026. Activision’s RICOCHET protects Call of Duty at kernel level and is generally rated harder to bypass than EAC or BattlEye, though still behind Vanguard by most security researchers’ accounts. FACEIT’s anti-cheat client, used for competitive Counter-Strike 2 matchmaking on top of Valve’s own VAC system, was grouped alongside Vanguard in the same academic rootkit-classification research cited earlier in this piece, making it one of only two systems studied to earn that label.
EA runs its own in-house systems, Javelin and Hyperion, across titles like Battlefield and Apex Legends rather than licensing EAC, BattlEye, or Vanguard, which is why EA-published games tend to have their own separate entries on Linux compatibility trackers instead of inheriting whatever status Epic or BattlEye GmbH report elsewhere. Valve’s own VAC (Valve Anti-Cheat) is older than all of these except BattlEye and takes a lighter, largely server-side approach rather than a deep kernel driver, which is part of why Valve-native anti-cheat has generally avoided the rootkit debate entirely.
The reason this comparison focuses on Easy Anti-Cheat, BattlEye, and Riot Vanguard specifically is coverage: together they protect the largest share of actively played multiplayer PC games outside of Valve’s own catalog and EA’s walled garden, and they represent three genuinely different philosophies rather than three variations on the same idea. RICOCHET and FACEIT are worth knowing about, but they don’t change the fundamental three-way trade-off between reach, balance, and raw strictness that defines this market.
Linux, Steam Deck, and SteamOS Compatibility
For anyone running a Steam Deck or a rival gaming handheld, or eyeing Valve’s upcoming Steam Machine, anti-cheat compatibility is the single biggest factor in whether a game library actually works. The community-run tracker Are We Anti-Cheat Yet currently monitors 1,166 anti-cheat-protected games and breaks their Linux status into five categories: 194 are fully Supported (The 17% (~194 out of 1,166) refers to “Supported” games in the broader “Are We Anti-Cheat Yet?” tracker as of June 2026, not Riot titles; the Linux anti-cheat breakdown is 194 Supported (~17%), 276 Running with caveats (~24%), 642 Broken (~55%), 52 Denied (~4%), and 2 Planned (~0.2%)[6].
| Status | Games | Share of 1,166 tracked | What it means |
|---|---|---|---|
| Supported | 194 | 17% | Fully playable on Linux/Steam Deck/SteamOS |
| Running | 276 | 24% | Playable with workarounds or minor issues |
| Broken | 642 | 55% | Currently non-functional on Linux |
| Denied | 52 | 4% | Publisher has explicitly blocked Linux |
| Planned | 2 | 0.2% | Linux support announced but not live |
The “Broken” and “Denied” categories get conflated constantly, but they describe different problems. Broken means the technical door is theoretically open, the anti-cheat vendor supports Linux, but the publisher hasn’t done the integration work to enable it for that specific title. Denied means the door is welded shut on purpose. Riot Vanguard accounts for two of the highest-profile Denied entries in the entire database, Valorant and League of Legends, and Riot has stated plainly that this is a deliberate choice rather than a bug to be fixed in a future patch.
Easy Anti-Cheat and BattlEye tell a more optimistic story, because both vendors built genuine Linux and Proton support and left the decision to enable it up to individual studios. That is why Rust and DayZ run fine on SteamOS-based handheld distributions like Bazzite or a standard Steam Deck, while Fortnite and PUBG, protected by those same vendors, remain broken simply because Epic and Krafton haven’t flipped the switch. Anyone building a Linux gaming setup, whether that means installing SteamOS on a ROG Ally or another handheld, should treat Are We Anti-Cheat Yet and GamingOnLinux’s anti-cheat tracker as mandatory pre-purchase checks rather than something to discover after a game refuses to launch.
Kernel Drivers, Rootkit Concerns, and the 2025-2026 Security Record
The rootkit comparison is not just internet hyperbole. Academic security research examining kernel-level anti-cheat architecture found that Riot Vanguard and FACEIT’s anti-cheat client exhibit characteristics consistent with rootkit-like software, based on how they hide, persist, and monitor at the driver level. The same research found that BattlEye and Easy Anti-Cheat showed only minor similarities to rootkit behavior, insufficient to earn that classification. That is a meaningful distinction: all three systems run in the kernel, but only two of them were judged to cross into genuinely rootkit-adjacent territory by researchers evaluating the underlying code.
Easy Anti-Cheat’s most consequential 2025-2026 security event was CVE-2021-47739, a local privilege escalation vulnerability rated CVSS 8.5. The bug exploits an unquoted service path in EAC 4.0, letting a local, unprivileged user run code with LocalSystem privileges if they can already access the machine. Zero Science Lab originally discovered the flaw in 2021, tracked internally as ZSL-2021-5652, but the vulnerability wasn’t formally assigned a CVE number and publicly disclosed until December 2025. A multi-year gap between discovery and formal disclosure is unusual and drew criticism from the security research community, even though the practical exploitation window required an attacker to already have local access.
Vanguard’s core controversy remains architectural rather than a single dated vulnerability: security researchers have repeatedly probed its Ring 0 driver for flaws given how much system access it holds from boot onward, and its system-wide blocklist of vulnerable third-party drivers, while defensible as a security measure, has occasionally conflicted with legitimate software that shares characteristics with blocked drivers. BattlEye’s 2025-2026 record is comparatively quiet, with periodic reports of false positives flagging legitimate players during server-side checks rather than any disclosed structural vulnerability.
None of the three publishers has released ban-wave statistics for 2025 or 2026. Epic, BattlEye GmbH, and Riot all confirm that bans happen (cross-game for EAC, per-publisher waves for BattlEye, HWID and account-based for Vanguard), but exact figures, like “X thousand accounts banned in Q1 2026”, are not publicly reported by any of the three. Anyone citing specific ban counts for these systems in 2026 is not working from official data.
If you want to check what’s actually running on your own machine rather than take any vendor’s word for it, Windows lets you query installed anti-cheat services directly:
sc query EasyAntiCheat
sc query BEDaisy
sc query vgc
sc query vgkEach command reports whether that specific driver is currently installed and running. A result of “The specified service does not exist” simply means that anti-cheat isn’t present on your system, which is the expected result unless you have the corresponding game installed.
Performance Impact: CPU and FPS Overhead
Performance complaints about kernel-level anti-cheat were louder five years ago than they are today. Across available testing, BattlEye and EAC both land in a light 1-Vanguard’s mandatory, always-on runtime model for League of Legends (since April 2024) does not give it an edge over BattlEye; the 2–3% FPS impact range cited applies to BattlEye, whereas Vanguard’s Ring 0 kernel access introduces higher overhead than BattlEye’s user-mode design[1][2]. Vanguard measures as the heaviest of the three, largely because of its always-on, boot-time footprint, but even Vanguard stays within that same rough 1-The “3% band on current hardware” refers to pre-On-Demand Vanguard overhead; as of June 24, 2026, PCs meeting the new hardware bar (Windows 11 25H2 with Secure Boot and TPM 2.0) experience near-zero runtime overhead because the kernel driver loads only at game launch and unloads on exit, eliminating the previously reported 2–3% FPS impact[1].
The honest caveat is that no single, independently published benchmark suite tests all three systems head-to-head under identical conditions, so these figures come from a mix of community testing and vendor-adjacent reporting rather than one controlled study. On current-generation hardware, including Nvidia’s RTX 40-series, AMD’s RX 7000 cards, and Intel Arc GPUs, the practical difference between all three is imperceptible during actual play. Older or budget hardware, including entry-level handhelds, is where any gap becomes more noticeable, mostly due to Vanguard’s persistent background presence rather than active scanning load.
Where the overhead becomes more relevant is startup time and background resource use rather than in-match frame rates. Vanguard’s boot-time driver adds a small, fixed cost to every Windows startup whether or not you play Valorant that session, while EAC and BattlEye only spend cycles while a protected game is actually open. On a modern NVMe-equipped desktop that difference is measured in milliseconds. On a battery-powered handheld running a full Windows install, it’s one more background process quietly drawing power between matches.
Developer Pricing and Licensing
For studios deciding which anti-cheat to integrate, cost and availability narrow the field fast. Only two of these three systems are actually available to license in the first place.
| System | Cost to developers | Availability | Support model |
|---|---|---|---|
| Easy Anti-Cheat | Free, bundled with Epic Online Services | Open to any developer | Epic-managed signature updates |
| BattlEye | Negotiated per-title licensing | Open to any developer, cost scales with studio size | BattlEye-managed, wave-based ban review |
| Riot Vanguard | Not licensed externally | Riot Games titles only | Riot in-house security team |
Easy Anti-Cheat’s free pricing under Epic Online Services is the biggest single reason it dominates by game count. A solo developer and a AAA studio pay the same amount: nothing. BattlEye’s negotiated model is friendlier to well-funded studios that can absorb licensing costs in exchange for its deeper memory scanning and more mature ban infrastructure, but it is a real budget line item that smaller teams have to weigh against EAC’s free tier. Vanguard isn’t a purchasing decision at all for outside developers, since Riot has never offered it as licensable middleware. It exists purely to protect Riot’s own two games, which is also exactly why it can afford to be so much more aggressive than the other two: Riot only has to support its own launcher, its own anti-cheat team, and its own hardware assumptions, not the enormous variety of engines and configurations that EAC and BattlEye have to accommodate across hundreds of licensees.
Why Game Studios Pick One Anti-Cheat Over Another
The choice rarely comes down to which system catches the most cheaters in isolation. Studios weigh engine compatibility, existing tooling relationships, genre stakes, and how much control they want to hand off to a third party.
Studios already building on Unreal Engine and Epic Online Services gravitate toward Easy Anti-Cheat almost by default, since the integration path is shorter and the price is already zero. That’s a large part of why EAC’s 100-plus game library spans so many genres and budget tiers: it’s the path of least resistance for any team that doesn’t have a specific reason to look elsewhere. Studios shipping extraction shooters, survival games, or military sims, genres where a single undetected cheater can wreck hours of other players’ progress, tend to lean toward BattlEye instead, trading EAC’s zero cost for deeper memory scanning and a ban model that isolates their game from unrelated titles’ enforcement decisions.
Riot never had to make this calculation as a purchasing decision, because Vanguard exists to serve exactly two internal products. That focus is precisely what lets it be more aggressive than middleware built to run across hundreds of unrelated engines and hardware configurations: Riot’s anti-cheat team only has to account for its own launcher and its own player base, not the compatibility matrix EAC and BattlEye must support across every licensee. No other major publisher has adopted Riot’s boot-time approach wholesale, which suggests most studios still judge the privacy and support cost too high relative to the marginal detection gain over BattlEye-style runtime scanning.
Ban Systems: HWID Bans, Ban Waves, and Appeals
How each system punishes cheaters is arguably more consequential for ordinary players than how it detects them, because ban policy determines what happens if the system gets it wrong.
Easy Anti-Cheat’s cross-game hardware ID bans are the most severe in scope. Because dozens of EAC titles share the same ban infrastructure, a violation in one game can lock a player’s hardware ID out of every other EAC-protected title they own, even ones from unrelated publishers. That is a powerful deterrent, but it also means an incorrectly flagged account carries a much heavier penalty than a single-game ban would.
BattlEye’s per-publisher model contains the blast radius. Because Battlestate Games, Ubisoft, and Krafton each manage their own BattlEye-enforced ban list independently, a Tarkov ban has zero effect on a Rainbow Six Siege account, even though both run BattlEye. BattlEye also favors batched ban waves over instant action, a deliberate choice that makes it harder for cheat developers to reverse-engineer exactly which detection method triggered the ban, since dozens of unrelated flags resolve at once.
Riot Vanguard combines hardware ID bans with account-level penalties, and because Valorant and League of Legends share Riot’s account infrastructure, a serious violation can realistically affect standing across both games. None of the three publishers has published exact appeal-success rates or ban-wave sizes for 2025 or 2026, so claims about “how easy” it is to get unbanned from any of them should be treated as anecdotal rather than official.
Migration Guide: What Changes When You Switch Between Anti-Cheat-Protected Games
Most PC gamers don’t run just one anti-cheat system, they run all three across their library without realizing it. Moving between EAC, BattlEye, and Vanguard titles involves a few practical steps that aren’t obvious until something breaks.
- Check Secure Boot and TPM 2.0 before installing Valorant or League of Legends. Vanguard requires both to be enabled in your BIOS/UEFI settings, and installation will fail or warn you if they’re off.
- Expect a reboot on Vanguard’s first install. Because vgk.sys loads at boot by default, Windows needs a restart to register the driver before the game will launch for the first time.
- Check Are We Anti-Cheat Yet before buying on Steam Deck or Linux, not after. A game’s anti-cheat vendor supporting Linux in general does not guarantee that specific title has opted in.
- Enable the right Proton or compatibility layer per title. EAC and BattlEye titles that support Linux often need a specific Proton version or Steam Play override rather than the default.
- Clean up orphaned kernel services after uninstalling. Some EAC and BattlEye titles leave their driver registered even after the game is removed. Use the
sc querycommands above to check, andsc deletewith the relevant service name (run as Administrator) if a leftover driver is confirmed and no other installed game still needs it. - Reinstall anti-cheat redistributables if a game reports an init failure. Both EAC and BattlEye ship standalone installers, typically in the game’s install folder, that can repair a corrupted driver registration without reinstalling the whole game.
- Budget for update cadence if you’re a developer switching middleware. EAC ships signature updates roughly weekly, while BattlEye’s cycle runs closer to biweekly. That gap affects how quickly newly discovered cheats get caught after integration.
The recurring theme is that these systems are not interchangeable plug-ins. Each one makes different assumptions about your boot process, your OS, and how much it’s allowed to touch outside of the game itself, so switching between them is closer to changing security software than switching game launchers.
Easy Anti-Cheat vs BattlEye vs Vanguard: Pros and Cons
Easy Anti-Cheat
- Pros: Free for developers, the widest game library by far, Linux-friendly when studios opt in, flexible kernel or user-mode deployment.
- Cons: Cross-game bans carry heavy collateral risk for falsely flagged accounts, widely regarded in security circles as the most bypassable of the three, and the multi-year gap before CVE-2021-47739 was formally disclosed raised real patch-transparency questions.
BattlEye
- Pros: Two decades of operating history, runtime-only loading instead of boot-time, per-publisher bans that limit collateral damage, genuine Linux collaboration with Valve.
- Cons: Slower signature update cadence than EAC, still kernel-level with the same fundamental privacy trade-offs, and several BattlEye titles remain Linux-broken purely because publishers haven’t enabled support that technically exists.
Riot Vanguard
- Pros: Consistently rated hardest to bypass, continuous kernel monitoring catches cheats other systems miss, system-wide vulnerable-driver blocklist adds protection beyond the game itself.
- Cons: Boot-time loading by default, explicitly and permanently blocks Linux and SteamOS, proprietary to Riot with no broader ecosystem benefit, and flagged by academic researchers as exhibiting rootkit-like characteristics.
Which Anti-Cheat Should You Trust? 5 Use-Case Recommendations
There isn’t a universal winner here, because “trust” means something different depending on what you’re optimizing for.
- Competitive players who prioritize clean matches above all else: Vanguard-protected titles currently offer the strongest anti-cheat guarantee available on PC. If you’re grinding ranked Valorant, that trade-off is arguably worth accepting.
- Steam Deck and Linux-first gamers: Stick to EAC and BattlEye titles that have confirmed Linux support, and check Are We Anti-Cheat Yet before every purchase. Avoid Vanguard titles on Linux entirely, since Riot has been explicit that support is not coming.
- Privacy-conscious players wary of boot-time kernel drivers: Favor BattlEye titles or user-mode EAC deployments over Vanguard, and consider Riot’s opt-in on-demand mode if you already play Valorant or League of Legends.
- Indie and solo developers choosing anti-cheat middleware: Easy Anti-Cheat’s free integration through Epic Online Services is the practical default for most budgets. BattlEye becomes worth the licensing cost once deep memory scanning and per-publisher ban control matter more than up-front price.
- Esports organizers and tournament administrators: Vanguard’s track record for competitive integrity is currently the benchmark other systems get measured against, but Windows-only enforcement needs to be planned into tournament hardware requirements ahead of time.
The Verdict
None of these three systems is simply “the best” anti-cheat, because they were built to optimize for different things and the data backs up each one’s trade-off. Easy Anti-Cheat wins on scale and openness: it’s free, it protects more than 100 games, and it’s the only one of the three that treats Linux support as a real, if opt-in, option across a wide catalog. BattlEye wins on balance: two decades of operating history, runtime-only loading, and per-publisher bans that don’t punish a Tarkov mistake with an R6 Siege lockout. Vanguard wins on raw effectiveness, full stop, at the direct cost of your boot sequence, your choice of operating system, and, per academic research, a rootkit-adjacent classification that neither competitor received.
For most PC gamers who value flexibility, especially anyone running a Steam Deck, a Steam Machine, or a dual-boot Linux setup, Easy Anti-Cheat’s combination of zero cost, broad adoption, and genuine opt-in Linux support makes it the most livable system day to day. For players who care only about the cleanest possible competitive match and don’t mind a Windows-only kernel driver running from the moment they boot, Vanguard’s reputation as the hardest of the three to bypass is backed by both researcher consensus and Riot’s own architecture choices. BattlEye remains the steady middle option for the extraction shooters and tactical titles that dominate its catalog, offering most of Vanguard’s seriousness without the boot-time footprint.
Frequently Asked Questions
Is Easy Anti-Cheat safe to install?
For the vast majority of players, yes. EAC is free, widely deployed across more than 100 games, and its kernel or user-mode driver only becomes a meaningful risk if a specific vulnerability like CVE-2021-47739 is actively exploited, which requires an attacker to already have local access to your machine. Keeping Windows and your games updated closes that gap.
Does BattlEye run all the time or only during games?
Only during games. BattlEye’s driver loads when a protected title launches and unloads when you close it, unlike Riot Vanguard, which defaults to loading at Windows boot regardless of whether you’re playing Valorant that day.
Why does Riot Vanguard load at Windows boot?
Riot’s stated reasoning is that cheats loaded before an anti-cheat system starts can otherwise evade detection entirely. By loading vgk.sys at boot, Vanguard can monitor every subsequent driver load on the system, not just ones that happen while Valorant is open. Riot introduced an opt-in on-demand mode in 2025 that disables this for players willing to accept a smaller protection trade-off.
Can I play Valorant or League of Legends on Steam Deck?
No. Both games are listed as Denied on Are We Anti-Cheat Yet, and Riot has confirmed Vanguard does not and will not support Linux or SteamOS. This is one of the few anti-cheat decisions in the industry described as a deliberate, permanent block rather than a pending technical fix.
What happens if I get banned by Easy Anti-Cheat?
Because EAC enforces bans through a shared hardware ID system across every game it protects, a single ban can lock you out of dozens of unrelated EAC titles at once, not just the game where the violation occurred. That cross-game scope is significantly broader than BattlEye’s per-publisher model or Vanguard’s Riot-only enforcement.
Is kernel-level anti-cheat a rootkit?
Not automatically, but the line is closer than publishers like to admit. Academic research evaluating kernel-level anti-cheat found that Riot Vanguard and FACEIT’s client exhibit rootkit-like characteristics, while BattlEye and Easy Anti-Cheat showed only minor similarities, not enough to earn that classification. All three still run in Ring 0 with far more system access than a typical application.
Which anti-cheat has the best Linux support?
Easy Anti-Cheat and BattlEye are effectively tied, since both vendors built real Proton compatibility and leave the decision to enable it up to individual publishers. Riot Vanguard has zero Linux support and Riot has stated it is not planned. Always check a specific game’s individual status on Are We Anti-Cheat Yet, since vendor-level support doesn’t guarantee any single title has opted in.
Do I need to pay for BattlEye or Easy Anti-Cheat as a player?
No. All three anti-cheat systems are free for players in every case. Only developers face licensing costs, and only for BattlEye. Easy Anti-Cheat is free for developers too, while Vanguard isn’t licensed to anyone outside Riot Games in the first place.
For more gaming platform coverage, visit the gaming section on Tech Insider.
Sources and further reading: Are We Anti-Cheat Yet, GamingOnLinux Anti-Cheat Compatibility List, Easy Anti-Cheat overview, BattlEye overview, Riot Vanguard overview, Riot’s official Vanguard FAQ, and CVE-2021-47739 technical detail.
