Kernel-level anti-cheat is game-security software that includes a driver running in the operating system’s kernel mode. That gives the driver privileges beyond those of an ordinary application. Developers use this access to help identify tampering that may be difficult to assess from the game process alone.
The term describes where a component operates. It does not, by itself, tell you when that component runs, which information it collects, or whether a particular game requires TPM 2.0 or Secure Boot.
This guide explains the distinction, compares two documented implementations, and outlines what to check when an anti-cheat error prevents a game from launching.
Technical sources reviewed: October 16, 2026. Product behavior and requirements can change.
What Does Kernel-Level Mean?
Windows separates ordinary applications from core operating-system operations through user mode and kernel mode. Applications generally run in user mode; core system components and many drivers run in kernel mode.
Microsoft explains that kernel-mode code is not isolated from the operating system in the same way as an ordinary application. A faulty kernel driver can therefore cause a system-wide crash.
For the underlying distinction, see Microsoft’s explanation of user mode and kernel mode.
User-Mode vs Kernel-Level Anti-Cheat
| Question | User-mode component | Kernel-mode component |
|---|---|---|
| Where does it run? | In an application process. | Within the operating system’s privileged kernel environment. |
| How isolated is it? | Windows provides process boundaries and restricted access. | It shares the kernel environment with other system components. |
| Does the label reveal when it starts? | No. Check the product documentation. | No. Check the product documentation. |
| Can one anti-cheat use both? | Yes. Riot describes Vanguard as combining a client with a kernel-mode driver. | |
Why Do Developers Use Kernel-Level Anti-Cheat?
EA says Javelin operates at kernel level to detect external cheats. Riot describes Vanguard as a combination of components intended to protect competitive integrity.
The practical point is that a game-security system may need to assess more than the game’s own code. However, the presence of a driver is not a measurement of effectiveness. Compare a publisher’s documented approach and limitations instead of treating “kernel-level” as a guarantee.
Does Kernel-Level Anti-Cheat Always Run?
No single startup rule applies to every implementation. The driver’s privilege level and its running schedule are separate properties.
Riot Vanguard
Riot’s support documentation describes a client that runs while its games are active alongside a kernel-mode driver.
In its June 2026 update, Riot introduced optional on-demand sessions for systems meeting its Vanguard Pre-Check requirements. In that mode, the driver launches with the game instead of at system startup. The option depends on the system meeting the stated requirements; it is not a universal change for every installation.
Read Riot’s Vanguard overview and Vanguard On-Demand update for the authoritative details.
EA Javelin Anticheat
EA’s 2026 update states that Javelin runs only while a game protected by Javelin is running. That is a useful example of why kernel access should not be confused with continuous operation.
See EA’s Javelin progress update for its current explanation.
Privacy, Security and Stability Questions
Privileged software deserves careful evaluation. Before installing a game’s required anti-cheat, consider:
- Publisher: Who develops and maintains the component?
- Operation: When does it run, and are different modes available?
- Data handling: What does the publisher say it collects, sends and retains?
- Maintenance: Where are updates and compatibility notices published?
- Removal: What is the official uninstall process, and what games depend on it?
Kernel access describes technical privilege, not a complete data-collection policy. It does not establish that every accessible file is collected. Equally, a privacy claim should be evaluated using the actual policy rather than assumed from the software’s name.
Are TPM 2.0 and Secure Boot the Same Thing?
No. These are separate security features that can appear in a game’s requirements. Their inclusion depends on the publisher, game and configuration.
Riot’s optional Vanguard Pre-Check illustrates the distinction: qualifying for an optional startup mode is a separate question from meeting the basic requirements to play.
Use our TPM 2.0 vs Secure Boot guide to understand those terms. Our UEFI vs Legacy BIOS guide explains how to check Windows boot mode.
Does an Anti-Cheat Error Mean You Are Banned?
A launch error alone is not enough to establish an account sanction. EA documents Javelin errors involving corrupted files and conflicting software, with different instructions for different error codes.
Record the exact message before troubleshooting. Keep an explicit ban notice separate from an installation, startup or compatibility error.
For terminology, see our HWID ban explainer. Use the publisher’s own support process to determine the status of a particular account.
What to Do When a Protected Game Will Not Launch
- Record the complete error message and code.
- Check the game publisher’s current requirements and service notices.
- Follow the official instructions matching that specific error.
- Prepare your Windows version, game version and recent system changes for support.
- If firmware changes are requested, consult instructions for your exact PC or motherboard before proceeding.
For Javelin, use EA’s installation and troubleshooting guide. EA notes that uninstalling Javelin makes games that require it unplayable until it is reinstalled.
For an overview of the games covered on this site, visit our PC game anti-cheat and Windows compatibility database.
Frequently Asked Questions
Is kernel-level anti-cheat the same as antivirus software?
No. The label identifies an execution level, not a product’s purpose. Anti-cheat focuses on game integrity; it should not be treated as a replacement for general device security.
Does every kernel anti-cheat start with Windows?
No. Startup behavior depends on the implementation and configuration. Check current publisher documentation.
Can kernel-level anti-cheat cause a blue screen?
A kernel-driver fault can crash Windows. A blue screen alone does not identify which driver caused it; diagnosis requires the relevant error information.
Can I play after uninstalling the required anti-cheat?
Check the game’s rules and documentation. For example, EA says games requiring Javelin will not be playable without it installed.
Does kernel access guarantee that all cheating is detected?
No. Execution privilege should not be presented as proof of perfect detection.
For a specific example used by Fortnite and Rust, read our Easy Anti-Cheat overview, covering game-specific installation help, common error categories and official support resources.
For provider-specific examples, see our BattlEye overview and Riot Vanguard guide. The Vanguard guide also separates normal game requirements from optional on-demand Pre-Check.
For EA-specific examples and support resources, see our Javelin Anticheat requirements and errors guide. It distinguishes operating-system access, runtime behavior and individual game requirements.
Denuvo provides an example of why exact product names matter. Our Denuvo Anti-Cheat and Anti-Tamper explainer distinguishes its kernel anti-cheat component from user-mode protection and DRM.