I've not run much hacking in my game (the group operates as sort of a blunt instrument on runs). I'm trying to figure something out. A Stealthed icon (decker, IC, whatever) resists the matrix perception test, and if they win, the icon making the perception test doesn't detect their presence. (Side note: I'll probably just make the Stealth program into the threshold for simplicity, though I know that makes it a bit more powerful on average. Doesn't matter too much, though.)

So how would you run cybercombat attacks from an undetected icon? My gut says there should be a penalty to defense or something (at least an initiative bonus). I don't use the surprise rules as written, so that's not an option for me.

Also, would attacking immediately reveal the icon? Or would the target have to keep trying to detect it?

Well my gut would be that the attacker attacks as normal, but the defender doesn't get to retaliate. EDIT: until he passes a matrix perception test. If your analyse program isn't up to it, tough cookies.

It depends on how you view the matrix, but ultimately the Attack program is not a physical blow, but malicious code. I wouldn't permit the defender to go on full defense as they don't know where the Attack program is coming from, but they would get their normal response+firewall check, as that is inherent in the hardware and software being attacked.

Likewise, Armour is redundancy programming, so would still operate. to resist damage.

Yeah, I get what you're saying. I really don't like that the defense roll is all hardware and software. I especially don't like that all of your comm attributes (other than signal) are involved in resisting attacks. It seems silly. Also, it means that defense in cybercombat is not an activity you engage in, as it is in other types of combat. It's completely passive. Hrrm.

That's just my trigger-happy house-ruling at work.

Anyway, I think you're right. At the very least, the effect is that they cannot perform any action (like attacks) targeting the icon until they detect it.

There isn't really such a thing as an undetected icon, as far as I know. The stealth program works by disguising your icon as inconspicuous whereas matrix perception would reveal what your icon really is (an unauthorized hacker) like an analyze icon action. So, in a sense, you're just an unidentified icon.

Attacks from an unidentified icon would work like attacks from any other icon, except that your inconspicuous nature would be instantly revealed as fraudulant to the IC under attack.

Basically, if the IC fails its Matrix Perception Test, there isn't really any reason to attack it. If it makes the Matrix Perception Test then it will attack you or you will attack it. If it fails the Matrix Perception Test but you attack it anyway, you have the exact same basic situation as if the IC had made the Matrix Perception Test in the first place.

Far as I'm concerned, "inconspicuous" and "undetected" are similar enough. I kinda like that idea of the stealth program confusing your readings of where the attack came from. Basically, stealth might make your icon seem like a natural part of the matrix architecture.

At least, that's how I intend to run it. I'll see how I like it in practice.