Valorant Vanguard: what 'detected' means vs a real ban
TL;DR
A VAN error at startup, a mid-session kick, and a wave ban are three different outcomes. Which one you got decides whether you can play tonight or wait a month.
If you're running our Valorant product, the badge on /status tells you whether it's clear to run. It's a fully external, color-based tool — it never injects into or reads the game's memory — so a Riot patch has nothing inside the process to break. The rest of this post is about what's happening on Riot's side.
The three outcomes
Startup error. VAN:9001, VAN:Restriction, VAN:1067, and the rest. This isn't a ban. It's a launch check failing — outdated BIOS, unsigned driver, hypervisor conflict. Read the code; the cause is in Riot's support article for it.
Mid-session kick. You're in a match, Vanguard catches something, the disconnect lands. The HWID gets logged. Sometimes a ban follows in minutes. Sometimes the flag sits for days until the next wave.
Wave ban. Riot batches them on purpose, so cheat developers can't reverse which signature got caught in real time. By the time the wave runs, the same flag has caught a lot of accounts. Wave bans aren't reversible.
What "Detected" on /status means
The badge on /status reflects internal testing. If it says Detected, our test accounts hit one of the three outcomes above on the current build — wait until it clears. Because the Valorant product is fully external and color-based, a Vanguard patch doesn't force an update cycle the way an injected cheat would; there's nothing inside the process for Riot to catch or for us to rebuild. /updates keeps the incident history.
What changed late 2025 and 2026
December 2025 — BIOS lockdown. Riot worked with ASUS, Gigabyte, MSI and ASRock on coordinated BIOS updates to close a gap in IOMMU (a CPU security feature) that hardware cheats were using to load before Vanguard came online. VAN:Restriction now triggers on outdated firmware. If you got that error recently, your BIOS is the first thing to check.
Wave volume. Riot publishes wave stats publicly and they're not small. If /status flips to Detected, the next wave is the reason to wait it out rather than test your luck.
June 2026 — on-demand mode. Vanguard can run only when Valorant launches, instead of starting with Windows. Requires Win11 25H2 + Secure Boot + TPM 2.0 + VBS + HVCI + IOMMU. Quieter for legit players, but the detection model is the same when the game is actually running.
Recovery
Startup error. Read the VAN code, patch BIOS, finish pending Windows updates, uninstall conflicting hypervisor tools, reinstall Vanguard.
Mid-session kick. Stop. Check /status before relaunching. If our build flipped to Detected, wait.
Wave ban email. Fresh account, on hardware Vanguard hasn't flagged. The free /spoofer doesn't cover Vanguard, and neither does anything else we ship — a Vanguard hardware ban means new hardware, not a spoof.
Before your first session of the day, /risk-disclosure is worth reading once.
Frequently asked questions
The fastest updates are in our Discord
We post detection windows, build notes and free spoofer releases in Discord before they hit /status. If you want the real-time view, join us there.
Keep reading
More from the blog
HWID ban: how to recover (account, hardware, or IP)
A ban hits your account, your hardware, or your IP — and each one needs a different fix. Diagnose first, then recover. The free Ambani spoofer covers the hardware layer.
Squad cheats and EAC: bans come from the admin cam, not the AC
Squad runs EAC, but Squad bans aren't really an EAC story. They're an admin-cam-plus-SquadJS story. That changes how a Squad cheat needs to be tuned.
How HWID spoofers work (and why ours reverts on reboot)
Our spoofer swaps the hardware IDs your anti-cheat uses to fingerprint your PC. It happens in RAM, for the current Windows session, so the real values come back on restart.