Riot has provided some details on the anti-cheat system for Valorant, and apparently, it starts with system bootup.
The information comes from a Riot team member posting to Reddit,
“TL;DR Yes we run a driver at system startup, it doesn't scan anything (unless the game is running), it's designed to take up as few system resources as possible and it doesn't communicate to our servers. You can remove it at anytime.”
Additional details include that the system, presumably called Vanguard, has a driver component called vgk.sys. It’s this component which requires a restart after you install the game. In fact, according the post, Vanguard won’t even consider your PC as “trusted” unless that component is loaded at system startup.
Riot further expands,
“This is good for stopping cheaters because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads.”
Naturally, a system like this may have security concerns, but Riot provides an update here as well,
“We've tried to be very careful with the security of the driver. We've had multiple external security research teams review it for flaws (we don't want to accidentally decrease the security of the computer like other anti-cheat drivers have done in the past). We're also following a least-privilege approach to the driver where the driver component does as little as possible preferring to let the non-driver component do the majority of work (also the non-driver component doesn't run unless the game is running).”
According to Riot, the Vanguard driver won’t collect or send any information about your PC back to Riot. The driver can also be uninstalled any time, and also doesn’t collect any info about your PC or communicate to Riot over the network, according to the team.
