[Shadowjack]

Okay so I've read the rules and had some successful albeit short runs as the GM, partially winging some things. From what I understand, a data steal run would go something like this:

1. Enter host with user access or administrator access only if required.
2. Patrol IC gets deployed and makes an immediate perception test to spot the hacker, then does another test every minute. Would the hacker actually even be in there a minute later?
3. Hacker does hash checks until they locate the file they're after.
4. Hacker teleports to the file location and uses an action (I forget, probe?) to defeat the defenses of the file.
5. Hacker acquires the file.
6. Jack out.

If at any point the hacker is detected by patrol IC the host begins to deploy one new IC per round, up until the number of IC matches the host rating. If the patrol IC does not spot the hacker then do they have free reign over the system or is there a way for the hacker to be noticed otherwise? Lastly, to create a larger system, multiple hosts can be attached, making the hacker have to beat multiple hosts and acquire user or admin access to the new hosts, giving extra chances to be caught. How far off am I?

[CigarSmoker]

[...] If the patrol IC does not spot the hacker then do they have free reign over the system or is there a way for the hacker to be noticed otherwise? [....]

-When the intruding hacker does something obvious in the real world like opening a secure door - with people watching - a security "Spider" could start looking for him as well.

- Overwatch score piles up as well each use of an illegal program gives +1 , each hit rolled by defense gives Overwatch as well. So when the intruding hacker needs too many rolls he will get close to 40 soon enough too.

But i think you got everything right as it is intended in the rules. 

[Shadowjack]

[...] If the patrol IC does not spot the hacker then do they have free reign over the system or is there a way for the hacker to be noticed otherwise? [....]

-When the intruding hacker does something obvious in the real world like opening a secure door - with people watching - a security "Spider" could start looking for him as well.

- Overwatch score piles up as well each use of an illegal program gives +1 , each hit rolled by defense gives Overwatch as well. So when the intruding hacker needs too many rolls he will get close to 40 soon enough too.

But i think you got everything right as it is intended in the rules. 

I'll keep those points in mind. Thanks I noticed IC have a massive reliance on active spiders in a host, which I thought was interesting.

[Banshee]

Shadowjack... I would say yes you have a pretty good understanding.  Just a quick note to add ( in addition to what CS said).

A host running on autopilot is pretty limited to programmed responses just as you described but that doesn't mean you can't modify those responses to be more of a challenge if you need them too.

Then as you noted it is a major game changer if there is a spider in the mix because then you are dealing with another person who is not restricted to same programmed limitations ... and of course if you really want to push the envelope even though there are no 6E rules yet who know what kind of hell you could unleash if the hist was home to an AI.

[Shadowjack]

Thanks, Banshee. I'm glad I'm not too far off the mark. Speaking of A.I's, back in 5E I ran an A.I for a decker that didn't know what an A.I was, it was very amusing