Vanguard hits new ‘Bans-Per-Second’ record.

Greetings travelers, I’m Phillip “mirageofpenguins” Koskinas, a data-based anti-cheater on the Vanguard team @ Riot. We saw a brief increase in reports on VALORANT over the past month, mostly in some of our more popular regions like Brazil, so we wanted to give a quick regional update on our never-ending war with cheaters and their apparent inability to get good at the video game.

Status Report

First things first, you weren’t hallucinating—there were definitely more cheaters over the last few weeks, but we’re thrilled to announce that they are rapidly falling back down to “optimal” levels.

Riot’s holiday break halts our release processes, so no new updates or hotfixes can go out to players. Cheat developers once again proved themselves to be perfectly willing to take advantage of the opportunity this presents, and without regular, new detections to deal with, even unsophisticated cheaters can quickly overwhelm a tactical FPS like VALORANT, where something as simple as a triggerbot can still be a massive advantage. So, while we were at reduced capacity, the cheaters that weren’t immediately detected started multiplying, a lot like a brainless pathogen.

(Red = Asia Pacific, Orange = Brazil, Green = Europe, Purple = Korea, Gold = Latin America, Blue = North America)

Above is our percentage of ranked VALORANT games with a cheater, broken down by region. Interestingly enough, the spikes coincide almost exactly with Riot’s holiday code freeze, and indeed, we are at our weakest when we cannot ship new detections. However, now that we’re back and the code has fully thawed, the kitchen is once again pumping out all 12-courses of anti-cheat with love and reckless abandon, bringing the percentage of ranked games with a cheater back down below 1% globally. We are optimistic that it will stay this way for several months, and in the future, we’re going to try and pre-plan “surprise” updates for cheaters to deal with over breaks in an effort to make sure they don’t ever get to play on easy mode (for any amount of time).

Now, it’s also apparent that there were regional differences, and your head is probably spinning at the realization that Brazil briefly hit 10% of ranked games with a cheater.

What’s up with Brazil?

Because Vanguard makes “internal” memory cheats less viable, Brazil cheaters have instead developed a regional taste for a type of abuse lovingly referred to as a “pixelbot” (aka colorbot). For those among us that are as virtuous as they are beautiful, a pixelbot is basically baby’s first cheat. Imagine a CV (computer vision) application that reads the screen and applies a simplified image classifier to each frame, quickly identifying an enemy outline or head. Then, utilizing a here-undisclosed method to submit mouse events, it quickly “adjusts” the cheater’s in-game direction towards what was identified. The reason they need “a method” to move the mouse is because Vanguard already outright rejects input from your non-primary peripheral device, and the reason I’m not disclosing that method here is because this is not a tutorial on fastest ways to get banned. 

Now, this probably sounds ridiculous to those of us that can already aim, but modern science has actually determined that cheaters do not have any discernable skill (otherwise they’d use it). So, while reading the screen isn’t quite good enough to warrant a high price tag (like say, a private DMA cheat), it’s definitely everything a cheater could’ve ever wished for. These things spread like wildfire, but luckily for us, they’re as easy to detect as they are to install—and we put most of them down pretty quickly.

That doesn’t mean that it didn’t suck to play against a bunch of aimless heathens, though. We know this caused a lot of frustration for our friends in Brazil, and we know how it feels to lose a game to a cheater. We are united in our animosity towards them, and that’s actually why we got into this anti-cheat business in the first place. Rest assured that we’re on the case, and we will continue fighting for your right to a game that’s free from players that don’t want to play it fairly. It might get a little rough from time to time, but we will never give up. 

What’s up with other regions?

Alright, speed round.

• KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.
• In that same vein, AP (Asia Pacific) sees a lot of CN (China) cheaters that dodge the identity requirements of their local servers by using VPNs in order to play elsewhere. We are working on better geofencing for Vanguard services that will make it harder for them to obtain valid anti-cheat sessions.
• As was anticipated, NA (North America) has pivoted towards expensive DMA hardware cheating, which can cost more than $1000 for a full setup. While marketed as “undetectable,” the sweetest dopamine on this green Earth is harvested directly from their Discord channels when you drop in with the monthly banwave.
• EU (Europe) has amusingly devolved back into circulating kernel cheats that leverage drivers with stolen or fraudulent certificates for “businesses” attempting to sound legitimate, like “Gary’s Pool Cleaners.” These are about as subtle as a brick to the head, so we don’t actually find detecting them to be too large an issue.
  • Special shoutout to TR (Turkey), which has many PC cafes with cheats pre-installed, either by previous customers or by the proprietor. This is annoying, as cafes are actually allowlisted through our device ban layer, freeing the cheater from the consequences. We’ve now started revoking this ban immunity from repeatedly offending locations.
• LA (Latin America) is still pixelbot country but with the important caveat that the required hardware has not permeated sufficiently to be undetectable for any period of time. We don’t find much difficulty here right now.

Why are there still cheaters?

We aim to make it as inconvenient and expensive to cheat as is physically and financially possible, but if a game is good, it’s going to attract cheaters. With an anti-cheat like Vanguard, most won’t bother, so those that persist are in it for the long haul—they’re cheaters, they run in communities of other cheaters, and the only way they’re going to play VALORANT is by cheating. It’s an addiction, and they will spend thousands of dollars on accounts and hardware just to keep accessing the rush that comes from pretending to be good at this video game. VALORANT is free-to-play with almost no barrier to entry, and there’s no such thing as truly “permanent” ban. Even with the best hardware fingerprinting in this universe at its disposal, Vanguard can only keep a determined cheater out for a little while—they will eventually get back in. 

Worse still, is that we actually have to let them back in. When we outright “block” a cheating method, we are technically providing the cheater an instantaneous surface to iterate against, allowing them to A/B test their cheats until they find something that is actually undetected at that layer. Unfortunately, cheaters do not have lives, so while it seems counterintuitive, the best way to make sure they stay detected is to slow down their iteration by obfuscating and delaying our response. We need to waste as much of a cheater’s time as is possible on each attempt, otherwise we’d quickly run out of tricks. 

Ultimately, it is inevitable that you will encounter a cheater eventually, but we will just keep banning them all over and over again until they finally work up the courage to run the uninstaller. Hey speaking of bans…

(Red = Manual, Orange = Behavior, Yellow = Hitchhiking, Green = Cheating, Blue = Hardware, Purple = Tampering)

Above is a timeline of all VALORANT x Vanguard bans in the last 120 days, broken down by the system in which the detection originated. 

• “Manual” is a bespoke ban hand-delivered, farm-to-table by one our Vanguard specialists.

• “Behavior” refers to an ML suspension (also called “server-sided” anti-cheat), often given to ragehackers.

• “Hitchhiking” is a player that deliberately queued with a cheater to gain rank (Vanguard deals splash damage).

• “Cheating” is an account detected explicitly for a cheat asset, usually having bypassed a hardware suspension.

• “Hardware” is a repeat offender who has tried to bypass the hardware fingerprinting and hilariously failed.

• “Tampering” is an agnostic detection for a cheater that is messin’ with Vanguard, which is expressly forbidden.

The weekend of January 10th to 13th was our highest sustained ban velocity on record, with almost 7 suspensions occurring every minute. That’s a lot of tears, but the most important metric for an anti-cheat is actually its detection speed. To measure this, we use a statistic called “time-to-action,” or the number of games a cheater is able to play before their account is violently polymerized with a reality in which it never existed. 2024 was our 2nd fastest year of all time, with the median cheater only being able to complete 6 games, and while we’d agree that this is 6 games more than they deserve, it’s the fastest we’re going to get with today’s technology. 

But what about losing to a cheater?

One of the problems with banning everyone all the time is that we’re slowly driving cheaters towards a behavior known as “ragehacking.” They’ve realized that they can’t play undetected, so they cheat as hard as possible for the few games they have before each suspension. It’s a lot like throwing a tantrum, and we’re a lot like a bewildered parent. The only real problem is that it ends up causing a lot of collateral damage.

So if we can’t get any faster, and cheaters aren’t ever going away, then what else can we do? Starting in Act 2, every ban will be accompanied by a “Ranked Rollback,” and like the name implies, this feature will restore the RR lost to all players affected by a cheater. We won’t remove any RR that you’ve accidentally won (if you were just put on their team), but if you’ve deliberately queued with cheaters, we will simply ban you for hitchhiking.

Additionally, we’re improving the notification systems around reporting a cheater successfully. Right now, the system is somewhat flawed, and you only get feedback if you’re logged in when the reported cheater is banned, but soon, we’ll move these into a “mailbox” system, where you’ll be warmly welcomed by a list of all the cheaters you’ve since reported correctly on every login. This will increase report accuracy over time (by letting you know when you’re right), allowing us to find the next generation of cheats faster.

What about cheat advertisements on TikTok?

Luckily, most of these are just desperate referral links using pre-recorded footage to give the appearance of something that hasn’t already been banned, and you can usually confirm such by looking up the account that they’re playing on (or just finding the client version watermark in the bottom right lolol).

However, some “enterprising” cheat developers started leveraging the lack of stream moderation on the platform by encouraging their users to advertise their cheats for them in exchange for a nebulous promise of “free” subscriptions in the future. Unfortunately for everyone involved, these are just the same rebranded, perma-detected cheats, and they’re using the few games they have before their ban sets in to sell as many subscriptions as they can until the inevitable exit scam. We’re not planning anything here; all we can say is don’t download them unless you’re into being banned.

In Closing

Cheaters are always working against Vanguard, and that’s why we can never stop. This cat and mouse game is one of unrelenting effort, but it’s one we’re always prepared to play. We’ll do pretty much anything it takes to encourage every single cheater to kick rocks, and we are firm in the stance that you’re not welcome in this community if you don’t want to play fair.

Thanks for reading, thanks for playing, and thanks for smashing the report button—it sustains me. Until next time.