NETRUNNING — CYBERPUNK RED (Player Reference)

Reconstructed from the running system: the AI-facing slim contract, the backend resolver code, and the in-engine stat tables. This is the rulebook the simulation actually enforces. Where it differs from the published RED rules, the differences are flagged as HOMEBREW in the section headers — those are deliberate departures, not drift.

The deterministic numbers in this doc (Program/ICE/Cyberdeck/Hardware stats, DVs, action counts, alert thresholds, cascade behavior) are the values the resolver uses on every roll. If you and the GM ever disagree about a stat, this doc is the source of truth — the published book may be slightly different in places.

1. The Three Tiers of Hacking

The GM picks a tier based on how dramatic the moment is, not just how secure the system looks.

Default to the lowest tier the situation supports. Upgrade only when the hack is dramatically interesting on its own.

2. Prerequisites

To operate a Cyberdeck, a Netrunner directly needs:

• Cyberdeck — The Netrunner's primary tool. External equipment, not cyberware (no Humanity cost). Worn on belt, wrist-mounted, or in a bag.
• Interface Plugs — 500 eb, 7 HL. Neuralware. The actual hardware requirement — without Interface Plugs the Cyberdeck is just an unwieldy laptop; you can't jack in. (Installing Interface Plugs requires a Neural Link as the foundational neuralware — 500 eb, 7 HL — so in practice every Netrunner has both, but the deck cares about the Plugs.)
• Virtuality Goggles — 100 eb. Strongly recommended. Lets the Netrunner see the NET overlaid on Meatspace. Without them, the Netrunner is Unconscious in Meatspace while Jacked In — they cannot move, dodge, or perceive the physical world. Their body is a sitting duck until they Jack Out.

A Bodyweight Suit (1,000 eb, SP 11 armor) grants +1 Cyberdeck slot when worn.

3. Cyberdecks

Cyberdecks have three quality tiers. Slots hold Programs or Hardware (shared pool). Cycles are a homebrew burst-capacity resource (see §5).

Hardware and Programs can be swapped freely (1 hour per install/uninstall). Upgrading is buying a higher-tier deck and migrating loadout.

4. NET Actions per Turn

The Netrunner's combat Action is spent on NET Actions. The number per turn scales with Interface Rank:

Move Action is free on top. Per RAW, every character gets 1 Move Action + 1 Action per turn. The Netrunner's NET Actions replace only the Action. They can walk, reposition, take cover (cover is part of the Move Action, not a separate cost), and burn all their NET Actions in the same turn — provided they're wearing Virtuality Goggles.

If they instead spend their Action on a Meat Action (shoot, reload, stabilize a teammate, a Tech check, etc.), the entire NET half of the turn is consumed. They do nothing in the NET that round, but the round still advances — Trace ICE ticks, Patrol ICE in their current node still scans, lingering-in-a-node penalties still apply.

5. Cycles (HOMEBREW)

Cycles are the Cyberdeck's processing overhead — burst capacity the Netrunner can spend on Boosted actions (see §15) and Disable counterplay (see §11). Basic NET actions cost zero Cycles.

• Cycle pool is set by the deck's quality (table in §3).
• Cycles refresh when the Netrunner Jacks Out and takes a few minutes to breathe — not mid-combat. Functionally a per-run resource.
• Cycles and Slots are independent. Spending a Cycle never costs a slot, and vice versa.

6. Quick Hack — 3-Node Linear

[Entry] ─── [Obstacle] ─── [Objective]

Same mechanics as a Full Run (§7) — same NET Actions, same ICE counterplay, same Cycles, same Alert system — but the structure is a straight shot with no routing.

Building one:

1. Set the SR based on the target. SR controls Base DV and ICE composition (§7 table).
2. Populate three nodes:
   • Entry — Light. Patrol ICE or a Password. The challenge isn't getting in, it's what's past the door.
   • Obstacle — Hardest. Black or Tar ICE, high-DV Password, or both. Where counterplay decisions matter.
   • Objective — File (Eye-Dee), Control Node (Control), or unguarded data. Moderate DV — the Obstacle was the real test.
3. Set Alert to 0.

Running it: normal initiative. NET Actions move the Netrunner through nodes, deal with ICE, interact with the Objective. A successful Complementary Skill check (Electronics/Security Tech, Cryptography, etc.) grants +1 to the next Interface check. Luck spends add 1:1 to Interface checks. A Netrunner with Interface 4–6 (3 NET Actions/turn) usually clears a Quick Hack in 2–3 rounds.

7. Full Run — Graph Architecture (HOMEBREW)

Departure from RED: published RED uses a linear floor-by-floor descent. This system uses a small node graph (4–6 nodes) with routing choices, so the Netrunner's path matters. The mechanical backbone (Interface + 1d10, DVs, Programs, Black ICE stat blocks) is preserved.

Building a System

Step 1 — Assign a Security Rating (SR):

Step 2 — Choose a Difficulty Rating (DV for the architecture's nodes):

All Password, File, and Control Node entries in an architecture share the same DV based on the chosen difficulty. DVs do not escalate by depth.

GMs may mix custom DVs across nodes for narrative purposes, but the default is uniform.

Lobby rule (CRB p.211): the first two nodes of an architecture may use lighter content regardless of the chosen rating — File DV 6, Password DV 6, or Password DV 8.

Step 3 — Draw the graph.

Always include:

• 1 Gateway (entry point)
• 1 Target Node (the prize)
• 2–4 intermediate nodes
• At least one routing choice (two paths to the Target)

Step 4 — Populate each node. Each node has exactly one of:

• ICE (one of the four behavioral types in §10)
• Password (Barrier) — Backdoor check vs DV
• File (Data Cache) — Eye-Dee check vs DV
• Control Node — Control check vs DV; controls real-world devices the rest of the crew cares about (cameras, doors, turrets, lights)

Key Architecture Rules

• Jack In within 6 m of an access point (8 m with Range Upgrade). Walls block the signal.
• Moving between connected nodes costs 1 NET Action.
• The Netrunner does not see the full map. They see the Gateway and its connections. Entering a node reveals that node's connections.
• Probe (free action — see §13) reveals one fact about an adjacent node.
• Pathfinder (Interface ability — see §16) reveals layout in chunks.
• Jacking Out resets the Architecture's defenses. To leave persistent changes, leave a Virus at the Target Node (§16).
• Leaving access-point range while still Jacked In = unsafe Jack Out. The cascade of all rezzed enemy Black ICE effects fires on the way out (see §22).

8. Programs

Programs are installed on the Cyberdeck and occupy 1 slot each (Black ICE programs occupy 2 slots). Activating or Deactivating a Program costs 1 NET Action. Attacker Programs Deactivate after use — re-Activate them with another NET Action. A Program at 0 REZ is Derezzed and unusable until Deactivated and Reactivated (2 NET Actions total). An Anti-Program Black ICE that drops a program to 0 REZ Destroys it permanently (unless the deck has a Backup Drive — see §9).

Boosters (passive while active)

Defenders

Attackers (Deactivate after use)

Black ICE on the Deck

A Netrunner can install their own Black ICE (anti-personnel or anti-program) on their deck — uses 2 slots. Stat blocks are the same as enemy Black ICE (§10). Useful for fighting enemy programs and other Netrunners.

9. Hardware

Hardware shares deck slots with Programs.

10. ICE — Intrusion Countermeasures

ICE occupies nodes. Stat blocks drive the dice; behavioral type drives the counterplay. Every ICE in the system is one of four types.

Behavioral Types

The behavioral type tells you what the ICE does. The stat block tells you how tough it is. A Patrol Wisp is a light scanner; a Patrol Raven is a sharper one. A Black Hellhound is an attack dog; a Black Kraken is a siege.

Anti-Personnel ICE Stat Blocks

These attack the Netrunner directly. Effect is the on-hit damage and special ability.

Defense hardware: Hellhound's fire is blocked by Insulated Wiring. Giant's forced Jack Out is blocked by KRASH Barrier (but not a death-cascade — physical disconnection from a flatline bypasses KRASH).

Anti-Program ICE Stat Blocks

These hammer Programs, not the Netrunner. They deal REZ damage; if the program drops to 0 REZ, the program is Destroyed (permanent loss unless Backup Drive is installed).

Convergence Auto-Spawn (HOMEBREW — Alert ≥ 7)

When Alert hits Convergence, the system automatically spawns a Black ICE at the Netrunner's current node. The type scales with SR:

This is in addition to whatever Black ICE was already deployed.

Lockdown Auto-Spawn (HOMEBREW — Alert ≥ 5)

When Alert hits Lockdown, a Trace ICE auto-spawns at the Gateway if no Trace is already active. Stats: name "Trace ICE", REZ = SR × 2.

11. Dealing with ICE — Four Options

12. NET Combat (Black ICE Engagement)

When a Black ICE detects the Netrunner and they choose to fight (or have no choice):

• Initiative: Interface + Speedy Gonzalvez bonus + 1d10 vs Black ICE SPD + 1d10. Loser eats the winner's effect immediately.
• Attack with a Program: Interface + Program ATK + 1d10 vs ICE DEF + 1d10. Damage = the Program's listed effect.
• Attack without a Program (Zap): Interface + 1d10 vs ICE DEF + 1d10. Deals 1d6 REZ damage on hit.
• Slide (flee): Interface + 1d10 vs ICE PER + 1d10. Success = escape to an adjacent node; the ICE stays where it was (does not follow). Once per Turn. Cannot Slide preemptively — the ICE has to be actively engaging you. This is the only way to escape a hunting Black ICE without derezzing it.

Black ICE Hunting: A triggered Black ICE pursues the Netrunner. If the Netrunner moves to a different node via Enter Node, the ICE follows on its next action. Only Slide, derezzing, or Jacking Out stops the pursuit.

Brain damage is applied directly to HP. It ignores worn/implanted armor and cannot cause Critical Injuries. Programs at 0 REZ are Derezzed (unusable until Deactivate + Reactivate, 2 NET Actions). Programs reduced to 0 REZ by Anti-Program ICE are Destroyed (permanent unless Backup Drive).

13. Demons (SR 4–5 only)

Demons are heavyweight ICE that operate Meatspace defenses (turrets, drones, automated traps). They occupy nodes near Control Nodes and cannot be stored in Cyberdecks. Maximum 1 Demon per 6 nodes.

Slide does not work against Demons. They must be derezzed or avoided entirely.

14. Alert Level (HOMEBREW — Tension Layer)

Alert is a homebrew tension dial layered on top of RAW. It tracks system awareness and escalates consequences as the Netrunner gets noisier.

Alert starts at 0. It only changes from events inside the Architecture — Meat Actions don't affect it.

Alert Increases

Alert Thresholds

When Alert crosses a threshold, the new effects apply immediately — they don't wait for the next exchange. They stack: DV +2 from Active Search persists through Lockdown and Convergence.

Reducing Alert

• Cloak (Interface ability): used before Jacking Out, hides evidence of the run. Does not reduce Alert mid-run, but determines whether the intrusion is later traceable. The DV for another Netrunner to discover the run = your Cloak check. Once per run.
• Mask (Boosted action, 1 Cycle): suppresses the Alert increase from the Netrunner's next failed check or loud action this round.
• No other mid-run reductions exist. Alert resets to 0 only when the Netrunner Jacks Out — but Alert's consequences (logged anomalies, dispatched security, notified owners) persist in the narrative.

15. Trace ICE & Convergence

When any Trace ICE is active and not derezzed/disabled:

• Trace progress ticks +1 at the end of each full turn (after all NET actions resolve).
• Trace completes when progress ≥ (6 − SR) (minimum 1 round). At SR 5 it's 1 round; at SR 1 it's 5 rounds.

On Trace completion:

1. The Netrunner's physical body location is burned — system owners know where the meat is.
2. If Alert < 7, Alert is set to 7 (Convergence triggers immediately, with all its effects).
3. Security teams are dispatched to the physical access point. Combat may break out in Meatspace.
4. The Netrunner can keep running, but the clock is now a meat-clock — the crew must protect the body or extract.

Derezzing or disabling a Trace ICE freezes trace_progress (does not reset it). If a new Trace spawns later (from Lockdown auto-spawn, etc.), it resumes from the frozen count.

16. NET Actions Reference

Basic Actions (1 NET Action each)

• Probe — FREE (0 NET Actions). From an adjacent node, learn one fact about the target node: ICE type, DV, or contents (Netrunner picks).
• Enter Node — Move to a connected node. Triggers any encounter in the destination (Patrol scans, Tar activates, Black attacks, Trace starts ticking).
• Backdoor Entry — Enter a node stealthily. Interface + 1d10 vs highest ICE PER in node + 1d10. Success = enter without triggering for 1 round.
• Brute Force — Enter past a Password without a check. Auto-success. Alert +2.
• Data Spike — Attack 1 ICE. Interface + 1d10 vs ICE DEF + 1d10. Success = ICE Derezzed. Alert +1.
• Jack In — Enter the Architecture (within 6 m / 8 m of access point).
• Jack Out — Disconnect safely. Resets Architecture defenses. Unsafe if Trace already completed.
• Interact — Read a File (Eye-Dee), use a Control Node (Control), download contents. May require an Interface check vs the node's DV.
• Activate / Deactivate Program — Ready or stow a Program from your Cyberdeck.
• Use Interface Ability — Backdoor, Cloak, Control, Eye-Dee, Pathfinder, Slide, Virus, Zap (see below).

Boosted Actions (1 NET Action + 1 Cycle each — HOMEBREW)

• Surge — +4 to your next Interface check this round.
• Mask — Suppress the Alert increase from your next failed check or loud action this round.
• Overclock — Gain +2 NET Actions immediately to this turn's pool (homerule: net +1 effective action for 1 Cycle, replacing the original "next NA does two actions" rule which was a strict net loss after the activation NA + Cycle cost).
• Fortify — Until your next turn, all brain damage you take is reduced by 4 (stacks with Armor program).
• Spoof Signal — Create a false signature at a node you've previously visited. Patrol ICE in your current node investigates the spoofed location instead of scanning you. Lasts 2 rounds.

Interface Abilities

All Interface checks: Interface + 1d10 (+ active Booster bonus) vs the listed DV or opposed roll.

• Scanner — Meat Action (not a NET Action). Locate access points to NET Architectures in the area.
• Backdoor — Break through a Password. Auto-pass if you already know the password.
• Cloak — Hide your presence/Viruses before Jack Out. Once per run.
• Control — Seize a Control Node. From anywhere in the Architecture (after first taking it). Operating each attached device costs a separate NET Action. One activation per Node per Turn. Lost on Jack Out unless backed by a Virus.
• Eye-Dee — Identify the contents of a File. Interface + 1d10 vs File DV.
• Pathfinder — Reveal Architecture layout. Reveals up to check result connected unrevealed nodes (BFS from your current node), stopping at any node whose DV exceeds your check (the obstruction itself is revealed; further exploration through it is blocked). Once per run.
• Slide — Escape combat with a single non-Demon Black ICE. Interface + 1d10 vs ICE PER + 1d10. Escape to an adjacent node; the ICE stays. Once per Turn. Cannot Slide preemptively.
• Virus — Available only at the Target Node. Leave a Virus to make up to 2 persistent changes to the Architecture (the only way changes survive Jack Out). DV to destroy your Virus = your Virus check.
• Zap — Basic attack, no Program required. Interface + 1d10 vs target DEF + 1d10. Deals 1d6 to REZ or directly to a Netrunner's brain.

17. Damage, Death, and Disconnection

Brain Damage

• Applied directly to HP. Ignores armor. Cannot cause Critical Injuries (RAW p.181 — environmental/non-physical damage exemption).
• Defender programs (Armor, Shield) and the Fortify boosted action reduce brain damage as listed.

Mortally Wounded at 0 HP (RAW p.187)

A character at 0 HP is Mortally Wounded but still conscious unless an effect explicitly knocks them out. They suffer:

• −4 to all Actions
• −6 MOVE (minimum 1)
• A Death Save at the start of each of their turns (d10 + cumulative DS penalty + Critical Injury DV mods − active RomS bonus vs BODY)
• Any attack that hits them automatically inflicts a Critical Injury (RAW p.189)

They can still take NET Actions, attempt a safe Jack Out, or be stabilized by an ally (Paramedic, First Aid, hospital).

Death Save Penalty (RAW p.189)

When a Mortally Wounded character is hit by an attack, their Death Save Penalty increases by +1 — per attack, not per damage point. The attack that first brings them to 0 HP does not itself trigger the penalty (it makes them MW; subsequent attacks trigger it). The penalty stays on the character until stabilized.

Forced Disconnect — RAW Conditions

The simulation auto-terminates the hack only on flatline (failed Death Save = dead). When a flatline fires:

1. Hack ends immediately.
2. Cascade fires: every rezzed Black ICE applies its full effect to the Netrunner on the way out — brain damage, fire, derez, debuffs, all of it.
3. KRASH Barrier does not block the cascade (physical disconnection from death bypasses software defenses).

Unconscious Netrunners — Sitting Duck Rule

An Unconscious Netrunner (sleep ammo, stun grenade, KO punch, biotoxin, etc.) does not disconnect. They remain jacked in but cannot:

• Take NET Actions
• Use Interface Abilities
• Jack Out themselves
• Defend in NET combat

Meanwhile, rezzed ICE and Demons keep acting on them every round. The Netrunner is helpless until either (a) they wake up or (b) an ally physically disconnects them (see §18).

18. Unsafe Jack Out

There are three ways an Unsafe Jack Out fires:

1. Giant ICE forced jack-out. Giant on-hit forces an unsafe disconnect.
2. DeckKRASH program. Anti-Netrunner attack that yanks the target's connection.
3. Physical disconnection by an ally (or self) — see below.

In all three cases, all rezzed enemy Black ICE fire their effects against the Netrunner on the way out — brain damage, fire, derez, debuffs, the works.

KRASH Barrier blocks (1) and (2) but not (3) — physical disconnection bypasses software.

Rescuing a Stuck Netrunner

If the Netrunner is Unconscious, Mortally Wounded and unable to act, or otherwise locked into the NET, the crew must physically disconnect them:

• Spend an Action (Meat Action — costs a turn)
• Choose: unplug the Cyberdeck OR drag the body out of access-point range (6 m / 8 m)

Either counts as an Unsafe Jack Out. The cascade fires. The Netrunner takes whatever ICE effects are still rezzed, but is now disconnected and can be stabilized, hospitalized, etc.

Self-yank: the Netrunner can also pull their own plug mid-hack if conscious. Same cascade, same consequences. Emergency exit.

19. Concurrency — Netrunning During Combat

Netrunning happens during regular combat initiative, not as a separate scene. The Netrunner rolls initiative with everyone else.

On their turn, the Netrunner picks either Meat Action(s) or NET Actions. While they descend through the Architecture, the rest of the crew is active in Meatspace: fighting guards, looting, holding position, running distractions. Control Node access (cameras off, doors unlocked, turrets flipped to face the enemy) is where the role shines for the whole table.

The Netrunner doesn't have to fight everything. Bypass and Slide let them move through fast. Probe is free — encourage scouting before committing to a path.

20. GM Cadence

Full Run Checklist

1. Determine SR based on the target system.
2. Draw 4–6 nodes with connections. Place ICE, Passwords, Files, Control Nodes. Ensure ≥1 routing choice.
3. Describe the Gateway and its visible connections.
4. Set Alert to 0.
5. Roll initiative with the full group.
6. Each round: Netrunner declares NET Actions → resolve → update Alert → describe new options. Other PCs take Meat Actions on their own initiative counts.
7. Target node reached or Jack Out = end.
8. Summarize: what was obtained, final Alert, real-world consequences (Trace completion, security response, logged intrusion, etc.).

When NOT to Run a Full Run

• The hack is a means to an end, not the scene itself → Simple Check.
• The player is eager to advance → Quick Hack at most.
• No meaningful risk or interesting choices → Simple Check.
• You've already run a Full Run this session → Quick Hack.

Node Design Principles

• Always offer a routing choice. Two paths to Target: one harder-but-rewarding (e.g., disable security for the Meatspace crew), one easier-but-with-compounding-costs (Patrol keeps scanning, ticking Alert).
• Mix ICE types. Don't put only Black in every node. Patrol creates tension, Tar creates resource pressure, Trace creates urgency, Black creates danger.
• Connect nodes to Meatspace. Control Nodes do things the rest of the crew cares about — cameras, doors, turrets, lights. Keeps the Netrunner's choices relevant to everyone.
• 4–6 nodes. More than 6 drags. Fewer than 4 kills routing.

Narration

Describe the NET as the Netrunner experiences it through Virtuality — not literal rooms, but an abstract digital landscape layered over reality.

• Corporate security = cold and geometric.
• Personal device = cluttered and warm.
• Military system = pressure and weight.
• Megacorp core = alive.

Use sensory language: data streams as light, ICE as presence or resistance, Passwords as density or cold. The Netrunner doesn't walk through corridors — they push through layers of information, with the real world still visible beneath the Virtuality overlay.

21. Quick DV Reference

22. Sample Architectures

Personal Device (SR 1, 3 Nodes)

[Gateway] ─── [Storage]
     │
[Comms Log]

• Gateway: Empty (no ICE). Just jack in.
• Storage: File (DV 9). Personal photos, contacts, messages.
• Comms Log: File (DV 13). Encrypted messages. Slightly harder, more valuable.

Maelstrom Den (SR 2, 4 Nodes)

[Gateway] ─── [Sec Cameras] ─── [Armory Access]
     │
[Crew Roster]

• Gateway: Patrol ICE (Wisp). Scanning for intruders.
• Sec Cameras: Control Node (DV 13). Disabling gives Meatspace crew free movement.
• Armory Access: Control Node (DV 15). Unlock the armory door remotely. Tar ICE (Skunk) slowing access.
• Crew Roster: File (DV 13). Names, addresses, augmentation records.

Routing: Cameras first (safer for the crew, Patrol ticks Alert) vs rush the Armory (faster, but the crew is still on cameras).

Meridian Regional Office (SR 3, 5 Nodes)

[Gateway: Patrol Wisp] ─── [Security Hub: Black Hellhound, Control DV 15] ─── [Admin Core: Password DV 17]
          │                                        │
          └── [Data Vault: File DV 13, Tar Skunk] ─┘
                    │
          [Research Archive: File DV 17, no ICE]

Routing: Through Security Hub (hard Hellhound fight, cameras dark, crew safer) vs skip to Data Vault (avoid fight, but Patrol keeps scanning and ticks Alert faster).

Arasaka Branch Office (SR 4, 6 Nodes)

[Gateway: Patrol Raven] ─── [Firewall Hub: Black Hellhound] ─── [Executive Files: Password DV 21]
     │                                          │
     └── [Personnel: Tar Scorpion, File DV 17] ─┤
            │                                   │
     [Server Farm: Trace Asp, File DV 17] ── [Ops Center: Control DV 21, Efreet Demon]

Three routing options:

• Through Firewall Hub (hard fight, but a clear road after).
• Through Personnel → Server Farm (avoid the fight, but Tar slows you and Trace is ticking).
• The long way through Server Farm → Ops Center (grab the Demon's toys for the Meatspace crew, but it's an SR-4 Demon fight).

23. Cyberdeck Loadout Examples

For when you're picking what to carry into a run.

Combat Netrunner (Excellent deck recommended)

Sword + Banhammer + Armor + Shield + Black ICE (2 slots) = 6 slots minimum. Cycles spent on Fortify and Overclock. Run-and-burn approach: derez fast, soak hits with defenders, jack out before Convergence.

Stealth Netrunner (Poor deck workable at low levels)

Eraser + See Ya + Worm + Armor + Shield = 5 slots. Cycles spent on Mask and Spoof Signal. Quiet path through the Architecture, leave no traces.

Support Netrunner (Excellent deck recommended)

Worm + See Ya + Flak + Shield + Speedy Gonzalvez = 5 slots. Add Hardware (KRASH Barrier, Insulated Wiring) for the remaining 4. Cycles spent on Surge and Overclock to grab Control Nodes fast for the Meatspace crew.