So I'm a combat decker (among other things) in a SR3 campaign and looking at some options for new programs to help with decking. One of the things I'm considering is the Validate program, so I can validate security or superuser accounts. It seems really powerful, the kind of thing which is difficult to get but wins everything.

So the question is this: what exactly is to stop me from logging on to a grid I need to hack on a future run, making a few attempts to validate a security or superuser account, then leaving before I rack up a security tally? If it doesn't work at first, what's to stop me from waiting for an hour or two while the security tally resets then coming back and trying again? Unless the TN is insane I should be able to get it in a few days and security access lets me do anything I would need on an ordinary run. With superuser status and a bit of planning, I basically own the grid. Hell, with superuser status, I can validate a new superuser account for when my current one runs out or if I want to let a friend in.

Am I missing something? It seems tough to get a decent Validate program and a deck that can run it but once you've got it, it seems like it makes decking a cakewalk.

I'm not familiar with SR3 matrix rules, but my guess would be that sysadmin check for this kind of unexpected accounts with high privileges quite routinely, and next time you enter said grid your once fine admin account may well be red-flagged and instantly drop as many icebergs on your head as are available.

Nothing is stopping you.
Keep in mind though that creating a superuser account has a +6 modifier, so it can be insane. It only lasts a number of days multiplied by your successes. With a difficulty that high, it's unlikely it will last long. In addition, if you are working the system at an odd time of day, say in the middle of the night, a security decker is more likely to notice something strange going on. However, if you work during the day, you might run into an authorized decker.
Also, even superusers can't do everything without making a test.
Hope this helps.