The short version: Vanguard loads with Windows at boot and stays resident whether or not you are playing; FACEIT AC loads when you start its client and unloads when you close it. That single difference drives almost every other distinction between them — hardware requirements, driver conflicts, and how much of your machine each one can see.
Why either of them is in the kernel at all
Windows separates user mode (ring 3) from kernel mode (ring 0). Ordinary applications, games included, run in user mode and cannot read another process's memory without asking the kernel for permission.
A cheat that also runs in user mode can be caught by a user-mode anti-cheat. But once cheat developers moved into the kernel — loading signed or exploited drivers to read game memory from ring 0 — a user-mode anti-cheat lost the argument structurally. It cannot observe code operating at a higher privilege level than itself. Both FACEIT and Riot went to the kernel because that is where their adversary already was.
The cost is real and worth stating plainly: a bug in a ring 0 driver is a system-wide crash or a privilege-escalation vulnerability, not a crashed game. You are extending a great deal of trust to a vendor's code quality.
Load model: the defining difference
Vanguard (vgk.sys)
Vanguard registers as a boot-start driver. It initialises during Windows startup, before most third-party software gets a chance to run, and it remains loaded for the entire session. Riot's reasoning is straightforward: a cheat that loads before the anti-cheat can hide itself from the anti-cheat. By being first, Vanguard gets to observe everything that loads afterward.
The consequence users feel is that Vanguard is running while you work, browse and use other programs — not only while you play. Riot has stated the driver does not collect data outside of game sessions, but the driver is resident regardless, and that is what people object to.
FACEIT AC
FACEIT's driver loads when you launch the FACEIT client and unloads when you exit it. It does not persist across reboots and is not present while you are doing anything else.
The trade-off is the mirror image of Vanguard's. Because FACEIT loads after Windows is fully up, a sufficiently sophisticated cheat that established itself earlier in the boot chain has a head start. FACEIT compensates with heavier runtime scanning and integrity checks rather than with load-order priority.
Hardware requirements
This is where most people first run into a wall.
Vanguard requires Secure Boot and TPM 2.0 on Windows 11. Not as a suggestion — the game refuses to launch without them. The reasoning is that Secure Boot enforces a verified boot chain, which blocks the unsigned or vulnerable drivers that kernel cheats rely on, and TPM provides a hardware-backed identifier for ban enforcement. On Windows 10 the requirement has historically been looser, but the direction is clear.
The practical fallout is a large volume of VAN9003 and VAN1067 errors from players whose machines are perfectly capable but were installed in legacy BIOS mode, or who have TPM disabled in firmware. We cover the diagnostic path in our guide to Vanguard hardware and IP bans.
FACEIT AC has historically been more permissive about Secure Boot, though it has tightened over time. It runs on a wider range of configurations without firmware changes, which is part of why it remains the practical default for CS2 competitive play.
What each one is looking for
Both use the same broad families of technique, weighted differently.
- Module and memory integrity. Enumerating what is loaded into the game process and verifying that game code in memory matches what shipped on disk. Catches injected DLLs and patched functions.
- Handle inspection. Watching which processes have opened a handle to the game with memory-read or memory-write rights. A background process holding
PROCESS_VM_READon the game is the classic external-cheat signature. - Driver enumeration. Listing loaded kernel drivers and flagging unsigned ones, known-vulnerable ones, and the leaked signed drivers cheat developers abuse to get their own code into ring 0.
- Hardware fingerprinting. Motherboard and SMBIOS serials, disk serials, MAC addresses, TPM endorsement keys where available — the basis of hardware bans. See our breakdown of how SMBIOS serials are structured and read.
- Behavioural and statistical analysis, server-side. Aim trajectories, reaction-time distributions and accuracy curves that fall outside human variance. This layer catches cheats the client-side layer never sees, and it is where both platforms invest most heavily now.
Vanguard leans harder on the boot-time and hardware-attestation side; FACEIT leans harder on runtime scanning and its own statistical model over match data.
Virtual machines
Both detect and refuse virtualised environments, and both do it aggressively, because running the game inside a VM while the cheat runs on the host is a well-established evasion path.
Vanguard in particular conflicts with Windows features built on Hyper-V — Virtualization-Based Security, Memory Integrity, WSL2, Windows Sandbox and Docker Desktop can all put your machine into a state Vanguard treats as suspicious. Users frequently end up choosing between running Valorant and running their development environment. FACEIT is generally more tolerant here, though not unconditionally.
Network telemetry, and what it is not
Neither product is a network surveillance tool, and it is worth separating the real concern from the imagined one.
Both platforms see your IP address, because you are connecting to their servers — as does every website you visit. Both use it for matchmaking region, latency routing, and as one signal among many for ban evasion: a new account appearing from the same address as a recently banned one is a flag, not a conviction.
What neither does is inspect your general internet traffic. The kernel driver's job is process and memory integrity on the local machine, not packet capture. VPN use is not itself bannable on either platform, though it can degrade your matchmaking and, on an address shared with banned accounts, can attract review.
Choosing, if you get to choose
Mostly you do not — the anti-cheat comes with the game. But if you are deciding whether to install FACEIT for CS2, or whether Valorant is worth the firmware changes, the trade-off is this:
Vanguard buys stronger guarantees at a higher cost to you. Boot-start plus Secure Boot plus TPM is a genuinely harder target, and Valorant's cheat problem is measurably smaller than comparable titles. You pay in a permanently resident driver and real conflicts with virtualisation.
FACEIT buys convenience at some cost to coverage. Load it when you play, unload it when you are done, keep your VMs. A determined kernel-level cheat that loaded before it has an advantage Vanguard would have denied.
Neither answer is wrong. What is wrong is installing either without understanding that you are loading third-party code into ring 0 of your own machine.