"There's no such thing as a secure system."
Sec-Ops specialists are the galaxy's elite hackers. They breach firewalls, subvert security systems, and wage electronic warfare against enemy networks. In an age where everything is connected, the Sec-Ops controls the battlefield before the first shot is fired.
Sec-Ops excel at:
They are the squad's digital key - unlocking access and denying it to enemies.
Sec-Ops specialists see the digital world as clearly as the physical one. They understand that data is power, and access is everything. Some are idealistic hacktivists; others are mercenary crackers who sell their skills to the highest bidder.
Consider:
| Skill | Application |
|---|---|
| Electronics - Hacking | Breaking into systems, forging tokens, network pings |
| Electronics - Hardware & Security | Manipulating physical security, counter-hacking |
| Electronics - Programming | Crafting exploits and payloads, writing daemons, robot control |
| Vehicles - Weapon Systems | Operating and upgrading the sentry gun |
| Term | Meaning |
|---|---|
| Ghost In | Clean network intrusion; no traces, no logs, no evidence you were ever there |
| Breadcrumb | A planted piece of false data designed to mislead forensic analysis |
| Skin | A false identity layered over existing records; the deeper the skin, the harder to peel |
| Brick | To permanently disable a device by corrupting its firmware; also what happens to your career if you get caught |
| Handshake | Establishing a covert connection; not always friendly |
| Puppet | A system you've taken control of without the operator knowing |
| Grey Area | Anything between legal and traceable; a Sec-Ops lives here |
| Payload | The actual objective hidden inside the hack; the thing that does the real damage |
From the encrypted logs of Sec-Ops designation "Cipher"; CREED Shadow Operative, Abandoned Science Ring KV-1138
The mission brief said containment. Roaming Organic loose on an abandoned science ring. Two-operative team. Standard sweep and secure.
Cipher read the brief twice and deleted it. Then read the other brief; the one that arrived through three encrypted relays and didn't officially exist. CREED shadow mandate. The science ring held data that certain parties wanted recovered, and certain other parties wanted destroyed. Cipher's job was to make sure the right data reached the right people and the wrong data reached everybody else.
The second operative was a Merc called Striker. Spearpoint Logistics. Good at his job, which meant predictable. Cipher had already mapped Striker's operational patterns from archived mission reports; where he moved, how he cleared rooms, when he synced his tactical HUD.
They docked at oh-six-hundred. Striker went left. Cipher went right. Professional courtesy. Neither mentioned their Black Ops objectives, because that was how Black Ops worked; two people on the same mission, fighting two different wars.
Cipher found the data core on deck three. Intact. The Roaming Organic had ignored it; animals don't care about server racks. Twelve minutes to ghost in, copy the target files, and begin the real work.
The fabrication took longer than the hack. Cipher was meticulous. Every piece of replacement data was handcrafted; timestamps adjusted, corporate signatures replicated, chain-of-custody logs reconstructed from scratch. The new data told a different story. A story where Spearpoint Logistics had funded the research that created the Roaming Organic. Falsified manifests. Diverted credits. A paper trail so clean that forensic auditors would weep with admiration.
Cipher planted the breadcrumbs at fourteen minutes. Sealed the data core at sixteen. By the time Striker finished clearing deck four, the evidence of his employer's involvement in an illegal bioweapons programme was forensically perfect and waiting to be discovered.
The firmware update was the elegant part. Cipher uploaded it to the shared network as a routine systems patch; the kind of file that tactical HUDs auto-accepted without operator confirmation. Striker's rig pulled it down during his next sync. He wouldn't notice the modification. Nobody ever noticed the modification. That was the point.
The Roaming Organic was contained by eleven hundred. Striker put three rounds in it. Efficient. Professional. He nodded at Cipher across the corridor, one operative to another, and Cipher nodded back.
They filed separate reports. Striker's went to Spearpoint. Cipher's went somewhere else entirely; three layers of encryption, routed through systems that would deny they existed.
Striker's account was frozen within the week. Security audit. Irregularities in Spearpoint's research funding. Nothing personal.
Cipher received a clearance upgrade. Level eight. The kind of access that doesn't appear on any record, because the record itself would be classified above the clearance of anyone who might read it.
Never earned. Taken. Like everything else that matters in the Core.
Best Legacies: Hacker, Information Broker, Spy
Best Origins: Human, Android, Rodi
Best Organizations: ICE, NERD, CORSEC
Core Skills: Electronics - Hacking, Electronics - Hardware & Security, Electronics - Programming, Vehicles - Weapon Systems
Suggested Skills: Systems - Sensors, Espionage - Stealth, Espionage - Search, Intel - Street Smarts
| Rank | Title |
|---|---|
| 2 | Code Jockey |
| 4 | System Breaker |
| 6 | Network Ghost |
| 8 | Elite Hacker |
| 10 | Digital God |
New Sec-Ops operatives begin with the following standard-issue gear:
| Item | Size | Description |
|---|---|---|
| Sidearm | Small | Compact pistol for self-defense |
| PAD (Personal Access Device) | Small | Forearm-mounted hacking computer; Storage, Memory, CPU |
| Signal Amplifier | Medium (2 slots) | Extends hacking range to Medium. 2 E-Cells/round while active |
| Static Sentry | Medium (2 slots) | Tripod-mounted auto-turret with camera. Small weapon. No IFF |
| Toolkit-Hacking (Std) | Small | Standard hacking tools |
| Toolkit-Hardware & Security (Std) | Small | Security bypass tools |
| Code Fragments (×6) | Tiny (×6) | Raw material for crafting exploits, tokens, and payloads |
| 10E-Cell | ; | Power pack for Signal Amplifier and equipment (10 charges) |
| Light Armor | ; | Low-profile protective gear |
Sec-Ops don't practice at the range; they hack the weapon's firmware until it aims itself. Your sentry gun uses vehicle targeting systems instead of personal weapon skill, because you're not pulling the trigger, your PAD is.
Personal Weapons
| Layer | Source | Cap |
|---|---|---|
| Core Weapon Training | 11 × Rank − 10 · off-specialty sidearm | 100 |
| Weapon Skill | +1% per SP in weapon type | 15 |
| Weapon Familiarity | +1% per hit with this specific weapon | 15 |
| Firmware Hack | +5% per tier hack (I/II/III) applied to this weapon | 15 |
| Max Accuracy Bonus | 130 |
Sentry Gun
| Layer | Source | Cap |
|---|---|---|
| Core Weapon Training | 11 × Rank · deployed same-Rank sentry (automatic) | 110 |
| Vehicles - Weapon Systems | +1% per SP invested | 15 |
| Weapon Familiarity | +1% per hit with this specific sentry weapon | 15 |
| Firmware Hack | +5% per tier hack (I/II/III) applied to sentry weapon | 15 |
| Max Accuracy Bonus | 155 |
"A locked door is just a terminal you haven't found yet."
Sec-Ops don't carry toolboxes; they carry a PAD (Personal Access Device), a military-grade hacking computer that turns every connected system into a weapon, a shield, or a doorway. Two resources govern your operations: CPU (how much your PAD can process simultaneously) and Code Fragments (the raw digital material consumed during crafting). Where other specialists fight with bullets and explosives, the Sec-Ops fights with access.
Your PAD is a Small forearm-mounted device with three subsystems:
| Subsystem | Function | Scaling |
|---|---|---|
| Storage | Internal digital storage for Code Fragments, Exploits, Access Tokens | 3 × Rank capacity |
| Memory | Holds compiled Payloads and active Daemons | Rank slots |
| CPU | Powers all sustained digital operations | 10 + (5 × Rank) |
| Rank | Storage | Memory | CPU |
|---|---|---|---|
| 1 | 3 | 1 | 15 |
| 2 | 6 | 2 | 20 |
| 3 | 9 | 3 | 25 |
| 4 | 12 | 4 | 30 |
| 5 | 15 | 5 | 35 |
| 6 | 18 | 6 | 40 |
| 7 | 21 | 7 | 45 |
| 8 | 24 | 8 | 50 |
| 9 | 27 | 9 | 55 |
| 10 | 30 | 10 | 60 |
Your PAD interfaces with your nervous system through a neural link; a hardwired connection implanted at the base of the skull. Commands to the PAD are issued at the speed of thought: you don't type, you think. Sensor feeds from hacked cameras, daemon output, and sentry gun footage are processed instinctively, overlaid on your perception like a second layer of reality.
Range: Short (within 15m). Your neural link maintains a persistent connection to your PAD within Short range. If you are separated from your PAD beyond this range, you lose all active hacks, sustained CPU effects, and sentry gun control until you reconnect.
Uses:
Unlike a Robonetic's neural link, the Sec-Ops link connects to the PAD only; not directly to drones or robots. There is no Synaptic Feedback risk. If a drone carrying your Remote Linkage module is destroyed, you lose the connection but suffer no neural backlash.
Node difficulty on the Node Map is derived from the mission's Threat Bands; see Mission Threat Bands for the full table. Each node is assigned a target based on its type:
| Node Type | Examples | Target |
|---|---|---|
| Access | Doors, elevators, airlocks, basic locks | Low Threshold |
| Sensor | Cameras, motion sensors, scanners | Mission TL |
| Control | Life support, gravity, lighting, comms | Mission TL |
| Weapon | Turrets, defense grids, automated drones | High Threshold |
| Server | Data cores, AI systems, command networks | High Threshold |
When you hack a system, you exist in one of four Intrusion States. Roll d100 + Electronics - Hacking vs the node's target (the target is set by node type; see the Threat Bands above). Your margin sets your entry state, following the same band pattern as a combat defence roll:
| Roll vs Node Target | Entry State |
|---|---|
| ≥ target + 30, or natural 96+ | Ghost |
| ≥ target | Covert |
| ≥ target ÷ 2 (but under target) | No entry; not detected |
| < target ÷ 2, or natural 1-5 | No entry; detected. Alarms trigger, system locks down |
Ghost; Invisible. Full access: observe, extract data, plant backdoors, inject payloads. No opposition. Actions that modify the system (opening doors, disabling cameras, planting payloads) require an Electronics - Hacking check vs the node's target.
Covert; Suspicious. Passive countermeasures active: re-authentication checks, log audits. Every action requires an Electronics - Hacking check vs the node's target.
Flagged, Detected. ICE deploys, alarms trigger. All hacking attempts at Bane(1). You gain Shaken(1) each round you remain connected, hostile countermeasures feed neural static through your link, accumulating Psych (see Conditions). You must roll Electronics - Hacking vs the node's target each round just to hold on, even if you take no other action.
Burned, Locked out. Ejected from the system. Cannot re-enter until the system is physically reset or you burn a Zero-Day Exploit. Security escalation, the GM may increase Mission TL for all squad members.
Every check you make while jacked in uses the same bands as your entry roll. A clean result climbs you back toward Ghost; a bad one slides you toward Burned:
| Roll vs Node Target | Shift |
|---|---|
| ≥ target + 30, or natural 96+ | Action succeeds; climb one state toward Ghost (never higher than Ghost) |
| ≥ target | Action succeeds; hold your state |
| ≥ target ÷ 2 (but under target) | Action fails; slip one state toward Burned |
| < target ÷ 2, or natural 1-5 | Action fails; slip two states toward Burned |
Climbing out of Flagged back to Covert clears the Bane(1) and stops the Shaken bleed. Slipping past Burned ejects you.
When your accumulated Psych reaches 2× your Rank, your PAD suffers a forced reboot; all sustained CPU effects drop immediately (active hacks, puppet nodes, daemons, worm networks). Your PAD comes back online at the start of your next turn with zero sustained effects. Any source of Psych counts toward this threshold.
The player tracks their own Intrusion State and Psych from hacking. You know when you've been flagged, and you know when you're close to a reboot. The GM doesn't need to track this for you.
Exploits are compiled defensive software; Tiny items stored in your PAD. Burn 1 Exploit to suppress a state degradation (stay at your current Intrusion State) OR force a system to re-roll a countermeasure check. Exploits are crafted from Code Fragments using Electronics - Programming (see Crafting below).
Code Fragments are the Sec-Ops' raw material; salvaged code, firmware scraps, encryption keys, and useful data harvested from terminals, droids, and electronic debris. They are digital assets stored on your PAD's internal storage, downloaded directly from compromised systems or read in from Data Chips and Data Sticks. Every dead terminal, every bricked droid, every abandoned server rack is a potential harvest.
Field Salvage: 1 Action, roll Electronics - Hacking vs Mission TL. Success = 1 Code Fragment + 1 per 5 points exceeding the TL.
Restocking:
| Method | Recovery |
|---|---|
| R&R | Full restock to PAD Storage capacity |
| Lockdown | Electronics - Hacking vs Mission TL. Success = 50% capacity. Fail = 25% capacity |
| Stim Break | None (unless you have the Field Compiler ability) |
| Field Salvage | 1 Action per attempt. 1 Fragment + 1 per 5 points exceeding TL. Requires electronic debris |
During R&R or Lockdown, Code Fragments are compiled into usable tools. Crafting takes 1 hour per item. The Batch Processing ability halves this to 30 minutes per item. The Field Compiler ability allows crafting 1 item during a Stim Break.
| Product | Fragment Cost | Crafting Skill | Notes |
|---|---|---|---|
| Exploit | 2 | Electronics - Programming vs Mission TL | Suppress Intrusion Ladder degradation or force re-roll |
| Access Token | 1 | No roll at crafting; rolled when used | See Access Tokens below. Sec Level 1 (Tier 1) nodes |
| Payload | 3 | Electronics - Programming vs Mission TL | Stored in PAD Memory. Requires Payload Compiler ability |
Access Tokens are pre-compiled credentials stored on your PAD. Crafting a token costs 1 Code Fragment and takes the standard crafting time; no roll is required at creation. The token's quality is determined when it is used.
When you deploy a token against a node, roll Electronics - Hacking vs the node's target:
Token tiers line up with the three Tiers of play: a token cracks nodes at its own tier. Basic Access Tokens (Core Training) work against Sec Level 1 (Tier 1) nodes; doors, locks, elevators, basic terminals. (Sec Level 0 is unrestricted; it has no lock to force.)
Higher-tier tokens require fabrication abilities: Advanced Tokens (Sec Level 2–3, Tier 2) and Skeleton Keys (Sec Level 4–5, Tier 3).
A smart Sec-Ops carries tokens in bulk; if one fails, burn an Exploit to suppress the alarm and try another.
Payloads are compiled malware stored in your PAD's Memory (1 slot per Payload). They are crafted from Code Fragments during R&R or Lockdown using Electronics - Programming and require the appropriate Payload Compiler ability (see Fabrication Sub-Tree).
Injection: 1 Action + Electronics - Hacking vs node target. Success = Payload planted in the target system.
| Type | Trigger | Base Effect |
|---|---|---|
| Virus | On Access (next user triggers it) | Corrupts target system; degrades function, spreads to connected nodes |
| Trojan | Remote (Extra Action to detonate) | Grants backdoor access; bypass Intrusion Ladder, enter at Ghost |
| Logic Bomb | Conditional (GM-set trigger) | Devastating single effect: system crash, data wipe, or total lockout |
| Worm | Automatic (spreads each round) | Propagates to connected nodes. Requires Worm Compiler ability |
The GM creates a Node Map that overlays the physical map of the mission environment. Every electronic system is a Node connected to other nodes by wiring and network pathways. The Node Map represents the digital terrain the Sec-Ops operates on.
Nodes can be discovered two ways:
| Method | Situation | Skill Roll | Result |
|---|---|---|---|
| External Scan | Not connected to the network | Systems - Sensors vs Mission TL | Reveals nearby nodes and types. Limited detail |
| Network Ping | Connected to a terminal on the network | Electronics - Hacking vs Mission TL | Reveals all connected nodes, types, security levels |
Adjacency: Compromising a node grants Boon(1) to hack connected nodes. A dense network of compromised nodes makes further expansion progressively easier.
Worm Tunnels: When a Worm network has propagated through a chain of connected nodes, a Worm Tunnel is established between the endpoints. You can hack a distant node directly through the tunnel; skipping every node in between. Worm Tunnels persist as long as the Worm network remains active. Requires the Worm Tunnel ability.
CPU = 10 + (5 × Rank). Your PAD's processing power is a pool; not allocated, just consumed by sustained effects. When total CPU drain exceeds your pool, you must shed sustained effects or suffer forced disconnection (all hacks drop, all puppets released, all daemons crash).
| Sustained Effect | CPU Drain/Round |
|---|---|
| Each Puppet Node controlled | 5 |
| Each active Daemon | 3 |
| Each active Worm network | 2 |
| Maintaining hack on Flagged system | 5 |
| Controlling Sentry Gun manually | 5 |
| Jamming an enemy system | 3 |
| Controlling a friendly/enemy robot | 5 |
| Harden Equipment (per item) | 1 |
The Signal Amplifier is a Medium item (2 slots) carried separately from the PAD. It extends your hacking range from jacked in to Medium range; but at a cost.
The Signal Amplifier makes the Sec-Ops powerful at range but dangerously detectable. This is why every Sec-Ops learns to set up a sentry gun first.
Every Sec-Ops starts with a Static Sentry; a tripod-mounted weapon slaved to their PAD with a basic camera feed. It is the Sec-Ops' bodyguard while they're neck-deep in cyberspace.
Base Sentry (Starting Equipment):
Sentry Accuracy: The sentry gun uses Vehicles - Weapon Systems (cap 15) in place of a standard Weapon Skill. Firmware Hacks can be applied to the sentry's mounted weapon; the same hack chain (I/II/III) works on any weapon you operate, including sentry armament.
The Sentry Gun is upgraded through the Fabrication Sub-Tree; from a dumb tripod that shoots at movement to a mobile, AI-controlled weapons platform with assault-class armament. An engineer ally (Rigger) can collaborate on mobility upgrades.
| Action | Skill |
|---|---|
| Hack into a system (Intrusion Ladder) | Electronics - Hacking vs node target |
| Deploy Access Tokens | Electronics - Hacking vs node target |
| Network Ping (reveal nodes from terminal) | Electronics - Hacking vs Mission TL |
| Bypass physical security (locks, doors) | Electronics - Hardware & Security vs target |
| Compile Exploits and Payloads | Electronics - Programming vs TL |
| Write Daemons, program sentry AI | Electronics - Programming vs TL |
| Hijack enemy robots/drones | Electronics - Hacking vs target's TL |
| External node scan, detect signals | Systems - Sensors vs TL |
| Camera sweeps (via hacked sensor nodes) | Systems - Sensors vs TL |
| Fire sentry gun | Vehicles - Weapon Systems vs Mission TL |
| Hide while broadcasting (Signal Amp) | Espionage - Stealth vs Mission TL |
| Social engineer credentials | Espionage - Social vs target resistance |
Stacking: Unless stated otherwise, skill tricks and core abilities stack. A Sec-Ops who purchases both a Hacking trick and a Sec-Ops ability that provide Boons to the same action receives both Boons.
The Fabrication Sub-Tree is a separate ability section from the main Ability Tree. All abilities cost AP from the same pool. Fabrication abilities determine what you can build and craft; the main Ability Tree determines what you can do in the field.
Every Sec-Ops can craft Exploits (2 Fragments, Electronics - Programming) and Access Tokens (1 Fragment, no roll at crafting; rolled when used) from Rank 1. No ability purchase required. Basic Access Tokens work against Sec Level 1 (Tier 1) nodes.
Cost: 2 AP
Requires: Tier 1
Effect: You can craft Virus and Trojan payloads (3 Code Fragments each, Electronics - Programming vs Mission TL). Payloads are stored in PAD Memory (1 slot each).
Cost: 2 AP
Requires: Tier 1
Effect: You can craft 1 item (Exploit, Token, or Payload) during a Stim Break instead of requiring a full Lockdown or R&R. Uses the normal crafting skill roll.
Downtime is a luxury. You compile on the clock.
Cost: 6 AP
Requires: Tier 2, Payload Compiler T1
Effect: You can craft Logic Bomb and Worm payloads (3 Code Fragments each, Electronics - Programming vs Mission TL).
Cost: 6 AP
Requires: Tier 2
Effect: Your crafting time is halved; 30 minutes per item instead of 1 hour. During a Stim Break with Field Compiler, you can craft 2 items instead of 1.
Assembly line efficiency. One brain, no waiting.
Cost: 6 AP
Requires: Tier 2
Effect: You can forge Advanced Access Tokens (2 Fragments each). Advanced Tokens work against Sec Level 2–3 (Tier 2) nodes; sensor arrays, control systems, restricted terminals, and corporate infrastructure. When deployed, roll Electronics - Hacking vs the node's target. Success = access granted without engaging the Intrusion Ladder.
The door says "Restricted." Your token says otherwise.
Cost: 10 AP
Requires: Tier 3, Advanced Tokens
Effect: You can forge Skeleton Keys (3 Fragments each). Skeleton Keys work against Sec Level 4–5 (Tier 3) nodes; weapon systems, server cores, command networks, classified infrastructure. When deployed, roll Electronics - Hacking vs the node's target. A Skeleton Key that succeeds works on any Sec Level 4–5 node at that difficulty level, not just the specific system it was crafted for.
One key. Every door on the station.
Cost: 10 AP
Requires: Tier 3
Effect: You can craft Zero-Day Exploits (5 Fragments, Electronics - Programming vs High Threshold). A Zero-Day Exploit bypasses any Security Level; servers, weapon systems, command networks, embedded infrastructure. When used, you automatically enter at Ghost with full administrative access. Crafted Zero-Day Exploits are stored in PAD Memory (1 slot each).
The skeleton key for the skeleton keys.
Sentry upgrades modify your Static Sentry. Each upgrade is permanent once purchased.
Cost: 2 AP
Requires: Tier 1
Effect: Your sentry recognises squad transponder signals. It will not fire on friendlies carrying an active transponder. Hostiles without a recognised signal are still targeted automatically. Squad members must carry a Transponder (Small item, purchasable from standard equipment vendors, Sec Level 0) for the IFF to recognise them.
Cost: 2 AP
Requires: Tier 1
Effect: Your sentry's camera system is upgraded to a multi-spectrum surveillance platform with variable zoom, infrared/thermal overlay, sonic/vibration detection, and UV spectrum capability. The feed is displayed on your PAD with full visual awareness of the sentry's field of view. The sentry functions as a remote surveillance camera even when not actively firing. Feed can be shared with squad comms. Zoom allows detailed observation at Medium range.
Eyes in the back of your head. Mounted on a tripod. Seeing in spectrums you can't.
Cost: 6 AP
Requires: Tier 2
Effect: Your sentry gains wheels or treads. Construction requires 2 Parts (sourced from a Rigger or purchased). It can be repositioned as 1 Action on your turn; move it up to 10m to a new firing position. An engineer ally (Rigger) can modify it for legs or hover propulsion (additional Parts cost at GM's discretion).
Cost: 6 AP
Requires: Tier 2
Effect: Your sentry can mount a Medium weapon class (rifles, carbines). Improved damage and range. Sentry size increases to Large (4 slots packed) when carrying a Medium weapon.
Cost: 6 AP
Requires: Tier 2, Medium Armament
Effect: Your sentry can mount an Assault weapon class. Significant firepower increase. Sentry size remains Large (4 slots packed).
That's not a sentry. That's a fire support platform.
Cost: 10 AP
Requires: Tier 3, Assault Armament
Effect: Your sentry can mount an Exotic weapon class. Sentry size remains Large (4 slots packed).
Cost: 10 AP
Requires: Tier 3, IFF Transponder
Effect: Your sentry gains full autonomous targeting AI. It selects friend from foe by behavioural analysis, not just transponder signals; it can identify hostile intent, track multiple targets, and prioritise threats. You can issue complex commands (hold fire, prioritise target type, suppress area, covering fire) as an Extra Action. No CPU drain for autonomous mode.
It thinks. It watches. It decides. You just point it at the door and forget about it.
Cost: 10 AP
Activation: Passive
Requires: Tier 3
Effect: You can deploy two sentry guns simultaneously. Both operate independently with all upgrades you've purchased. Each must be packed and deployed separately (1 Action each). Inventory cost is doubled (2× sentry size).
I don't know how you are going to carry that, but it sure as hell's gon'a be fun when we get there.
All Sec-Ops abilities are purchased with Ability Points (AP) during R&R. Abilities are organised by function: Attack (offensive hacking and electronic warfare), Defense (protecting allies and counter-hacking), and Utility (intelligence, automation, and support).
Cost: 2 AP
Activation: 1 Action
Requires: Tier 1
Effect: Perform a quick analysis of a connected system. Learn its node type, Security Level, active defenses, and connected nodes. Gain Boon(1) to your first hacking attempt against this system.
Cost: 2 AP
Activation: Passive
Requires: Tier 1
Effect: Your System Probe takes an Extra Action instead of 1 Action, allowing you to assess a system's defenses in the same turn you begin your intrusion.
Knock and enter. Why wait?
Cost: 2 AP
Activation: Passive
Requires: Tier 1
Effect: You passively detect encrypted wifi communications within 50 metres. You are aware of the signal's origin, strength, and encryption type, though intercepting content requires a separate hacking attempt.
Every transmission is an invitation. Most people just don't know they sent one.
Cost: 2 AP
Activation: Passive
Requires: Tier 1
Effect: You gain Boon(1) to hacking attempts against similar security systems you have encountered before during this mission or a previous mission. Your PAD catalogues defensive patterns for future exploitation.
Same firewall twice? That's not security; that's nostalgia.
Cost: 2 AP
Activation: Passive
Requires: Tier 1
Effect: Whenever you successfully hack or probe a system, you automatically map all directly connected nodes on the Node Map. This map can be shared with your squad via comms and is stored in your PAD.
One node gives you the neighbourhood. The neighbourhood gives you the city.
Cost: 2 AP
Activation: 1 Action
Requires: Tier 1
Effect: Target enemy's communications within Medium range. Roll Electronics - Hacking vs target's TL. Success = target's voice comms are jammed. They cannot communicate with allies, call reinforcements, or receive orders. Sustained: 3 CPU/round.
Cost: 2 AP
Activation: Heroic Action (1 HE, triggered: an enemy hacker targets your squad's electronics; comms, weapons, armour systems, drones)
Requires: Tier 1
Frequency: Once per round
Effect: Contest the hack with your own Electronics - Hacking check. Success = the hack is blocked.
You want in? Go through me.
Cost: 2 AP
Activation: Passive
Requires: Tier 1
Effect: Reduce the time required to bypass encryption by half (Extended Hacking Maneuvers take half as many rounds; minimum 1 Action). Your pattern recognition algorithms crack cipher keys faster than standard brute-force methods.
Encryption is just a puzzle. You like puzzles.
Cost: 2 AP
Activation: 2 Actions
Requires: Tier 1
Effect: Take control of an enemy robot, drone, or automated turret. Roll Electronics - Hacking vs the target's TL (or Mission TL for uncontrolled systems). Success = the target becomes your Puppet Node (5 CPU/round). Issue commands as 1 Action via PAD. An enemy Robonetic whose drone is hijacked suffers Synaptic Feedback as their neural link is forcibly severed.
Their turret. Your turret. A small but important distinction.
Cost: 2 AP
Activation: 1 Action
Requires: Tier 1
Effect: Deploy a Daemon, a semi-autonomous software agent, into a hacked system. Roll Electronics - Programming vs Mission TL. The Daemon operates independently, performing one of two functions: Monitor (reports all activity in the system) or Extract (copies data over time). Sustained: 3 CPU/round per Daemon. At the start of each round, the Daemon rolls against the system's TL, failure = detected and purged.
Cost: 2 AP
Activation: 1 Action (install)
Requires: Tier 1
Effect: Install a Remote Linkage module, a hardline jack and PAD relay, on any compatible drone (1 Action to install, 2 Code Fragments). The drone can navigate to a terminal and plug in automatically. You hack through the drone as if physically jacked in, no Signal Amplifier required, your physical position remains hidden. The drone moves at its own speed and uses its own SP. You can only have 1 active Remote Linkage at a time. Drone not included, purchase a simple drone separately (see Droids).
Why walk to the terminal when you can send something with legs?
Cost: 2 AP
Activation: 1 Action
Requires: Tier 1
Effect: Protect your squad's electronics from enemy hacking within Short range. All friendly electronic devices gain Boon(1) to resist hacking attempts. This includes Robonetic droids, powered armour systems, comms, and weapon electronics. Sustained: 2 CPU/round.
Cost: 2 AP
Activation: 1 Action
Requires: Tier 1
Effect: A willing Robonetic operator hands off control of 1 of their constructed robots to you. The robot no longer counts against the Robonetic's Multi-Unit Control limit; freeing them to build and control more droids. You control the robot via your PAD. Sustained: 5 CPU/round. Commands cost 1 Action each. Uses Electronics - Programming for commands. If the robot is destroyed, neither you nor the Robonetic suffers Synaptic Feedback.
Cost: 3 AP
Activation: 1 hour (downtime)
Requires: Tier 1
Effect: Hack a weapon's targeting firmware. Roll Espionage - Hacking vs Mission TL. On success, that specific weapon permanently gains +5% accuracy for you. On failure by 10 or more, the weapon is bricked (destroyed). Each weapon can only receive one Firmware Hack per tier.
You didn't modify the gun. You taught it to think.
Cost: 6 AP
Activation: Extended Action (during successful hack)
Requires: Tier 2
Effect: When you successfully hack a system, you may install a persistent backdoor. Future access to this system is automatic (no roll required) and enters at Ghost until the backdoor is detected and removed.
Cost: 6 AP
Activation: Passive
Requires: Tier 2, Backdoor Access
Effect: Your backdoors are hardened against detection. They persist indefinitely until manually discovered and removed by a technician with an Electronics - Hacking check that exceeds your TL. Standard automated security sweeps cannot detect them.
Good code outlives its author. Great code outlives the system it's hiding in.
Cost: 6 AP
Activation: 2 Actions
Requires: Tier 2
Effect: Target all electronic equipment within Medium range. Roll Electronics - Hardware & Security vs Mission TL. Each enemy whose TL you exceed has their equipment disabled. Affected equipment remains offline until the target spends 1 Action to reset it. Affects weapons with electronic components, communications, sensors, and powered armour systems.
Cost: 6 AP
Activation: 1 Action
Requires: Tier 2
Frequency: Once per encounter
Effect: Emit a targeted EMP burst disabling all electronics within 10 metres for 1 round; friend and foe alike. Affected devices include comms, targeting systems, powered armour assists, and electronic sights. Consumes 20 E-Cells.
Everything in range goes dark. Everything.
Cost: 6 AP
Activation: Passive
Requires: Tier 2
Effect: You can maintain active hacks on 2 systems simultaneously without penalty. Normally, maintaining a hack on one system while attempting to access another imposes Bane(1); this ability removes that penalty.
Two screens, two exploits, one brain. Plenty.
Cost: 6 AP
Activation: Passive
Requires: Tier 2, Crypto-Breaker
Effect: When you spend 1 Action to hack a node, you may attempt a second node as an Extra Action in the same turn. Both rolls are made separately. If either hack drops you to Flagged, both connections are affected.
Left hand, right hand. Both typing.
Cost: 6 AP
Activation: Passive
Requires: Tier 2
Effect: You gain Boon(1) to all interactions with AI systems; including hacking, negotiation, reprogramming, and diagnostics. You understand AI behavioural patterns intuitively and can predict their responses with uncanny accuracy.
You speak machine. Fluently.
Cost: 6 AP
Activation: 1 Action
Requires: Tier 2
Effect: Consume 2 Code Fragments and begin rotating encryption keys across friendly equipment within Medium range. All allies gain Boon(2) to resist hacking and intrusion attempts. Sustained: 1 CPU/round per item protected. Lasts until you drop it or run out of CPU.
Your PAD broadcasts rotating security keys. Good luck cracking what changes every cycle.
Cost: 6 AP
Activation: 1 Action
Requires: Tier 2, Firewall (Short)
Effect: Extends your Firewall protection to Medium range. All friendly electronic devices within Medium range gain Boon(1) to resist hacking attempts. This includes Robonetic droids, powered armour systems, comms, and weapon electronics. Sustained: 3 CPU/round. Replaces Firewall (Short) when active.
Cost: 6 AP
Activation: Passive
Requires: Tier 2, Network Mapper
Effect: Your Network Mapper now reveals nodes 2 hops out from any compromised system. Additionally, mapped nodes reveal their node type and Security Level automatically, without requiring a separate System Probe.
The map draws itself. You just have to look.
Cost: 6 AP
Activation: 1 Action
Requires: Tier 2
Effect: Jam enemy electronic targeting systems within Medium range. Roll Electronics - Hardware & Security vs Mission TL. Success = all affected enemies suffer Bane(1) to ranged attack rolls for as long as the jam is sustained. Sustained: 3 CPU/round.
Their sights say one thing. Yea naaa.
Cost: 6 AP
Activation: 1 Action
Requires: Tier 2
Effect: Push your PAD beyond its rated limits. Gain +15 CPU for the remainder of the encounter. 3 E-Cells/round while overclocked. Can be deactivated as 1 Action. Cannot be stacked; one Overclock at a time.
Red lines are for other people.
Cost: 6 AP
Activation: Passive
Requires: Tier 2, Deploy Daemon
Effect: Your Daemons can now perform two additional functions: Disrupt (causes periodic malfunctions in the host system) and Infiltrate (slowly probes connected systems, auto-discovering adjacent nodes). Daemons can chain tasks; an Infiltrate Daemon that reaches a new system can automatically hand off to a Monitor or Extract Daemon deployed into the same system.
Cost: 6 AP
Activation: 1 Action
Requires: Tier 2
Effect: Plant a Worm payload (requires Worm Compiler). The Worm automatically spreads to 1 connected node per round; roll your Electronics - Hacking vs the target node's TL. Nodes infiltrated by your Worm grant Boon(1) to all future hacking attempts against them. Sustained: 2 CPU/round per Worm network.
Plant it and walk away. It does the rest.
Cost: 6 AP
Activation: Passive
Requires: Tier 2, Worm Seeding
Effect: When your Worm network has propagated through a chain of connected nodes, a Worm Tunnel is established between the endpoints. You can hack a distant node directly through the tunnel; skipping every node in between. Worm Tunnels are persistent as long as the Worm network remains active.
Why fight through the front door when you've already dug under the foundation?
Cost: 6 AP
Activation: Passive
Requires: Tier 2, Link Assist T1
Effect: You can control up to 2 friendly robots simultaneously via Link Assist (up from 1). Each still costs 5 CPU/round.
Cost: 3 AP
Activation: 1 hour (downtime)
Requires: Tier 2, Firmware Hack I applied to this weapon
Effect: Apply a second firmware hack to a weapon that already has Firmware Hack I. Roll Espionage - Hacking vs Mission TL. On success, the weapon gains an additional +5% accuracy (total +10%). If the roll is Tanked (≤ TL ÷ 2) or a natural 1-5, the weapon is bricked.
Deeper access. Deeper risk. The weapon's learning.
Cost: 10 AP
Activation: 1 Action
Requires: Tier 3
Frequency: Once per mission
Effect: Automatically succeed on any single hacking attempt, regardless of difficulty. The target system has no chance to detect your intrusion. You enter at Ghost with full administrative access.
Cost: 10 AP
Activation: Passive
Requires: Tier 3, Zero-Day Exploit
Effect: Your Zero-Day Exploit can be used twice per mission instead of once. Each use is independent; you may target different systems or the same system on separate occasions.
One zero-day is a weapon. Two is a campaign.
Cost: 10 AP
Activation: Passive
Requires: Tier 3
Effect: When controlling a Puppet Node, you may use its capabilities as if physically present; security cameras, door controls, weapon systems, environmental systems. Your hacking attempts cannot trigger system lockouts. Multi-Thread penalty removed for all simultaneous hacks. Puppet Node CPU cost reduced to 3 CPU/round (from 5).
The system doesn't belong to them anymore. It belongs to you. All of it.
Cost: 10 AP
Activation: Passive
Requires: Tier 3
Effect: You cannot be traced, tracked, or identified through digital means. Your network footprint is zero; no logs, no metadata, no forensic trail. Attempts to trace your hacking attempts automatically fail. This extends to digital surveillance: cameras, motion sensors, and electronic tracking systems do not register your digital presence. Your Signal Amplifier no longer requires Espionage - Stealth defence rolls.
You don't exist online. You never did.
Cost: 10 AP
Activation: Passive
Requires: Tier 3
Effect: When you crash or disable a networked system, make an Electronics - Hacking check. Each connected system whose TL you exceed also crashes. The cascade continues through the network; each crashed system's connections are checked against your roll. A single system whose TL exceeds your roll stops the cascade along that branch.
Pull one thread. Watch the whole tapestry unravel.
Cost: 10 AP
Activation: 1 Action
Requires: Tier 3
Effect: Apply quantum-grade encryption to your squad's communications for the remainder of the encounter. Encrypted comms cannot be intercepted, jammed, or spoofed by any means short of a Zero-Day Exploit. All allies within comms range benefit.
Your channel. Your rules. Nobody else gets a vote.
Cost: 10 AP
Activation: 1 Action
Requires: Tier 3, Harden Equipment
Effect: Extends Harden Equipment to full immunity. All friendly electronics within Medium range become immune to hacking for the remainder of the encounter. This includes drones, powered armour, comms, weapon systems, and cybernetics. Sustained: 10 CPU/round.
Nothing gets through. Nothing.
Cost: 10 AP
Activation: Passive
Requires: Tier 3, Worm Seeding
Effect: Your Worms spread to 2 connected nodes per round instead of 1. Nodes infiltrated by your Worms grant Boon(3) to all future hacking attempts (up from Boon(1)). Your Worm networks are hardened; they resist purging attempts with your Hacking skill as if you were actively defending them.
It's everywhere. It's in everything. And it's yours.
Cost: 10 AP
Activation: Passive
Requires: Tier 3, Advanced Daemon
Effect: You can deploy up to 3 Daemons simultaneously. Daemons gain Boon(1) to their survival rolls against system TL. If you have an AI module installed in your PAD, Daemons gain additional Boon equal to the AI module's tier. Daemons can chain tasks between each other; an Infiltrate Daemon in one system can trigger an Extract Daemon in another.
Cost: 10 AP
Activation: Passive
Requires: Tier 3, Link Assist T2
Effect: You can control up to 3 friendly robots simultaneously via Link Assist (up from 2). Each still costs 5 CPU/round. Additionally, your commands to Link Assist robots cost an Extra Action instead of 1 Action.
Cost: 3 AP
Activation: 1 hour (downtime)
Requires: Tier 3, Firmware Hack II applied to this weapon
Effect: Apply the final firmware hack to a weapon that already has Firmware Hack II. Roll Espionage - Hacking vs Mission TL. On success, the weapon gains an additional +5% accuracy (total +15%). If the roll is Tanked (≤ TL ÷ 2) or a natural 1-5, the weapon is bricked.
At this point, the weapon's targeting AI is basically sentient. Don't tell Ethics.
"The best hack leaves no trace. The perfect hack leaves someone else's."
— Cipher, CREED