The primary argument against letting Riot run a kernel-mode driver on your PC is that if someone found a security vulnerability in it, the consequences could be much worse than if a vulnerability were discovered in regular, user-level software. Software that runs at the kernel level has the greatest level of control over your PC. It's the core of your operating system, where the most basic functions happen, such as allocating system memory to different programs. If we were in a '90s hacker movie, the kernel would be the virtual reality sphere of green code where the final showdown takes place. What does it mean that the Vanguard driver is 'kernel-mode'? That's why you have to reboot after installing Vanguard. If Vanguard's driver isn't started with Windows, Valorant won't trust your PC, and you won't be able to play. It doesn't collect data about your PC or send anything to Riot: It looks at other drivers and blocks them from running if it detects that they have a known vulnerability that could be used to compromise the anti-cheat client. (Vanguard blocks fewer programs as of an update in May, and in the future may prevent Valorant from running instead of blocking the offending software.) The kernel-mode driver is the client's bodyguard, basically. A client that checks to make sure you aren't running any cheats while you're playing Valorant.A kernel-mode driver that runs when your PC boots up.

Faceit anti cheat effective