Riot Games has turned its anti-cheat campaign into a public challenge, offering up to $100,000 to ethical hackers who can expose serious flaws in Vanguard, the kernel-level system that protects League of Legends and Valorant. The move is part of a broader push to keep matches fair in 2026, when cheat developers are more organized and hardware exploits are more sophisticated than ever. Riot is not simply asking researchers to test its defenses; it is paying them to break them, provided they follow strict rules.
Vanguard is Riot's crown jewel in the fight against cheating. It runs at the kernel level, the deepest part of a PC, to detect cheats before they can ruin a match. That approach has helped Riot keep hackers at bay more effectively than many competitors, including titles such as Call of Duty, where cheating remains a persistent complaint. Vanguard has proven useful against everything from aimbots to questionable hardware exploits, but its deep access has also drawn scrutiny from players concerned about privacy. The bounty program does not erase those concerns, but it does show how far Riot is willing to go to harden its defenses.
According to a listing on HackerOne, Riot is ready to reward researchers who find exploitable vulnerabilities in Vanguard's kernel-level driver. HackerOne connects organizations with ethical hackers, effectively acting as a matchmaking service for companies that want to strengthen their digital security. Rockstar Games and Epic Games are among the major gaming companies that have used the platform for their own bug bounty programs. Riot has been present on HackerOne for some time, but it has recently bolstered its efforts around Vanguard and is offering larger payouts than before.
The bounty menu is tiered by attack vector and impact:
| Attack scenario | Kernel-level code execution | Unauthorized data access |
|---|---|---|
| Network attack with no user interaction | Up to $100,000 | Up to $75,000 |
| Network attack requiring user interaction | Up to $75,000 | Up to $50,000 |
| Local attack for privilege escalation | Up to $35,000 | Up to $25,000 |
Those figures make Riot's intent clear. The highest rewards are reserved for the most dangerous flaws: remote, no-interaction attacks that could lead to kernel-level code execution. A payout of that size signals that Riot views such vulnerabilities as critical, not cosmetic. The program is not a free-for-all, however. Bounties apply only to exploits within Vanguard's kernel-level driver. Researchers must submit a solid proof of concept and follow strict submission rules. If they speak publicly about an exploit they have found, they become ineligible to cash in on that bounty.
Why would Riot invite outsiders to attack its own anti-cheat system? The answer is partly practical and partly strategic. By incentivizing security researchers to find Vanguard's soft spots, Riot hopes to patch potential vulnerabilities before malicious hackers can weaponize them. A flaw that reaches the wrong hands could undermine trust in two of Riot's biggest games, so paying for responsible disclosure is cheaper than cleaning up after a major exploit. The program also gives Riot a controlled channel for feedback from people who understand low-level security better than most players ever will.
Still, the initiative raises familiar questions. Does a kernel-level anti-cheat system need to be this invasive to be effective? Can a bounty program meaningfully address privacy worries, or does it simply make the system more resilient without changing its fundamental design? Riot's bet is that transparency and crowdsourced security can coexist with deep system access. Whether players accept that trade-off is a separate matter, and the debate over kernel-level anti-cheat is unlikely to fade in 2026.
For the wider industry, the message is just as important as the money. Crowdsourcing security has become a new standard, and Riot is using serious cash to set the bar. The company is not only defending League of Legends and Valorant; it is showing that anti-cheat is now a security discipline, not just a game feature. Ethical hackers may be invited to do their worst, but Riot's real goal is to make sure malicious actors find fewer openings when they try.
This assessment draws from ESRB, whose standards around interactive software oversight help frame why kernel-level anti-cheat systems like Vanguard remain under close public scrutiny. In the context of Riot's expanded bug bounty effort, broader industry trust is shaped not only by technical effectiveness against cheating, but also by how clearly companies communicate security practices, system access, and player protections when deploying deeply embedded game defense tools.