InfoSec Briefing - August 10, 2026

🎧 Audio Briefing

Playback Speed:

This is the BlueTeamSec briefing for Monday the 10th of August 2026. Just one story today, but it's a notable shift in how kernel-level anti-cheat works on Windows.

Riot Games announced Vanguard On-Demand, a new mode for their anti-cheat driver that lets it load when you launch the game rather than requiring a reboot. The catch is you need Windows 11 with all the security features turned on — Secure Boot, TPM, virtualisation-based security, the lot. It's an interesting pivot given the recent work on Windows bootkits and privilege escalation we've been tracking — essentially trading boot-time persistence for runtime attestation, assuming the platform itself is locked down. Worth a look if you're interested in how trust boundaries are evolving in kernel driver design.

That's all for today. The original article is from Riot Games — the analysis here was automated.

📰 Articles Covered

Incoming: Vanguard On-Demand - Microsoft built a Runtime Driver Attestation Report that lets Vanguard verify driver integrity without needing to be present at boot. - Riot Games

Riot Games officially introduced "Vanguard On-Demand" on June 24, 2026, marking a significant shift in how their kernel-level anti-cheat operates 【1】【4】.

### What Happened
Historically, Vanguard’s driver component was required to load at system startup, creating an "always-on" security posture. With the introduction of the On-Demand mode, Riot now allows the driver to remain dormant until a game is launched. This change is gated behind "Vanguard Pre-Check," a system-level security verification process that ensures the user's PC meets modern hardware-backed security standards before enabling the on-demand behavior 【1】【3】.

### Who is Affected
- **Eligible Players:** Users running Windows 11 (25H2 or later) who possess hardware capable of supporting a strict "security stack." Those who pass the Vanguard Pre-Check are eligible to opt into the on-demand configuration 【3】【4】.
- **Ineligible/Older Systems:** Players who do not meet these stringent security requirements or are on older operating systems must continue using the traditional "always-on" implementation to maintain the integrity of the anti-cheat environment 【1】.

### Technical Details & Requirements
To enable Vanguard On-Demand, the system must demonstrate high-integrity hardware and OS configurations. Key technical requirements include 【3】:
* **OS:** Windows 11 (25H2).
* **Firmware/Hardware:** UEFI Secure Boot enabled and TPM 2.0 present/ready.
* **Virtualization:** Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) must be enabled and running.
* **Memory Protection:** IOMMU (Input-Output Memory Management Unit) support.

### Security Implications
Riot’s move represents a shift toward "Trust Segmentation." By requiring a hardened environment, Riot can move the anti-cheat driver from a boot-time load to a session-based load without compromising the root-of-trust. This acknowledges that on systems where hardware-backed security (like VBS and HVCI) is active, the OS is sufficiently protected to prevent unauthorized pre-boot code injection, thereby reducing the "pre-boot gap" that previously mandated early driver loading 【2】.

### What Defenders Should Know
- **Hardware-Backed Security is Critical:** This update highlights a growing trend where software applications (especially high-privilege ones like anti-cheats) rely on modern hardware security features (TPM, VBS, IOMMU) to dictate software behavior.
- **Verification of Trust:** For security practitioners, Vanguard Pre-Check serves as a practical model for how to evaluate the "health" of a device before allowing elevated access to sensitive or protected memory spaces.
- **Troubleshooting:** Defenders and users can verify their compliance with these requirements using standard Windows tools:
- **Secure Boot:** `Confirm-SecureBootUEFI` (PowerShell).
- **TPM:** `Get-Tpm` (PowerShell).
- **VBS/HVCI:** `msinfo32` (checking for "Device Guard Virtualization based security" and "Hypervisor enforced Code Integrity") 【2】.