I'm just wondering how to handle IC in SR4. It was really laid out in SR3 however as far as I can tell the host is only limited by response degredation. However that isn't so restrictive and a host with 6's in all it's ratings could easily lauch a half dozen IC with attack programs.

From the PC side of the coin why can't I start with a good comlink, an IC and attack program and use the software duplicate action to run a number of copies at the same time.

Or is that just part of making Hacking faster. Instead of working your way up the ladder of IC like some weird version of mortal combat you have to fight a bunch at once and you either can beat them or you can't.

IC are the digital version of security guards. Rather than have them all over the building and show up sparadically, why not just have them all piled up wherever the runner's happen to enter from? Rather than have the HTR team show up, why not just assume they're already there and will blast runners as they approach the facility?

Basically, IC are supposed to be deployed in the same way security is employed against physical deckers. They probably won't even show up until the runner trips an alarm, and then a few IC will show up to trace the runner or boot him off the system, and then the whole gang of high-threat response IC shows up.

But remember the Response degredations for each program (IC) running. I would count IC that has been destroyed by a hacker as "still running" for awhile for response purposes.

I handle IC in a program exactly like physical guards on patrol. You can hide from them (with the Stealth program) and they use perception (Pilot + Analyze) try and find you. If they find you, then there's cybercombat or alerts or hackers or whatever, that parts up to you. I think what you're asking, though, is how many IC to put on a system? Again, that's up to you. I don't limit my hosts to a System rating of 6 especially for larger corps, for example, while you may want to do so. But, as you say, you can run IC programs to roughly (System x 2)-1 usually without too much of a problem, which can provide for a small army running around in a host if you need it.

As for your PCs starting with one Agent program and an Attack program and spawning small armies of their own, I don't see why that would be a problem. Clearly, if they run too many programs then their system will suffer which will also effect their initiative and the initiative of their brood. Just remember to load up that zergling icon when you pull this trick

'Course, when you dump that brood onto a host, that host could be running Analyze on itself to detect increases or decreases in its responsiveness and might start alerting hackers that something strange is going on if you pull this one too often.

As an aside, I often state that if you screw up the software duplication, you destroy the software from which you're duplicating. Not that bad for common-use programs but this house rule has kept my gamers from pirating some of the higher-rating hacking and agent programs that were purchased at character generation.

it is worth noting that a rating 4 agent with attack, armor, and analyse (just as an example) running, counts as 4 programs towards your program load. i would assume the same applies to IC.

The FAQ has info on this, though it also isnt totally clear...

I like the "destroy programs you fail to dupe" a bit. Not sure if I'll use it. Maybe.

What I do use is the idea that the more copies of a program there are around the more it is protected against. Sort of like the upkeep type stuff from virtual realities. It at least keeps copying from getting too rampant in general.

I suppose I can see having IC have to find people after an alert has been triggered. It would give the runner a chance of doing something before getting gang banged and running was often a good option under the old rules.

SGM 0.9 (SR4 interpretation)
SGM 1.1 (SR4 Matrix rewrite)

Both cover IC, how it works and how it can be balanced and so on

I treat IC as an effect of a secure system and not a security guard. There are no perception rolls on the part of the system. If you succeed at your rolls with no problems against a fairly high threshold then there is no problems. You have convinced the system that you should be there. There is nothing for the spider or IC to notice because as far as the system is concerned nothing is wrong.

I treat Stealth as a negation of the first (rating) alert levels. Any alert levels past that act as automatic successes for a perception test for security. It is a matter of how much you screw up not how many people are looking.

Speaking from the standpoint of a security guard for nearly 10 years I can tell you that high level attentiveness is exhausting. You can't keep it up (which is one of the reasons I get online at work). The idea of a system admin staring at everything and making constant perception tests doesn't work. The other problem is that if you have spoofed the system then there is nothing to notice in the first place. Unless you only have one user in a system there is too much data. They would just wait around for an alarm like any other guard.

If you are basing the idea of IC as guards noticing strange behavior you have several problems. Why create an IC with enough psycology to know what is strange behavior? How do you know that their strange behavior isn't the result of multiple open links and they are either standing there focused on them or are reacting in the wrong link? If the system is saying a user belongs then why add to the problem and irritate normal users?

The other thing that people tend to miss is that there is no reason for a VR room representing every area. The user may perceive it that way but for the system it would just bog down resources. There would be meeting areas and chat rooms as well as secretary agents in VR. The rest would just be files. Your own commlink may provide a room metaphor for it but why would the server bother?

It is one thing of having a security guard agent (IC) show up and ask questions if they notice a problem but all this is metaphors. The server will have enough interface in VR to allow for normal and useful interacting. It doesn't actually fall for it's metaphors and create VR rooms for every block of file data so that people will see it as a room full of filing cabinets. Major social rooms would be rendered with most people's office on their commlink. The rest is gravy (or data in this case). It could spawn a new agent for each active conversation and then delete them again once they finish talking. It's not like the agent sits around waiting in a back room, drinking coffee data, and chatting with the other processes.