Cyberpunk RED Netrunning Guide: NET Architecture, Black ICE, And Crew Play

The short answer

Cyberpunk RED netrunning works best as one part of a physical job, not as a solo mini-game. The Netrunner has to find and stay near a local access point, work through a NET Architecture's floors, handle programs and Black ICE, and use Control Nodes or Files to change what the rest of the crew can do in Meatspace.

At the table it runs like this: the team gets the Netrunner to the system, protects the route and the access point, and acts on the opening the Netrunner creates. The Netrunner buys the crew a door, a camera loop, an elevator, an alarm delay, a data file, or a new complication. This guide covers the whole loop, from the kit and the NET Action economy to building an Architecture, running Black ICE and Demons, and keeping every player in the scene.

Hot take

Black ICE is a weak centerpiece. It earns its place by guarding something the crew wants. The worst way to run a Netrunner is to announce a hack, turn away from the other players, and start a private puzzle. The Core Rulebook already builds the better version: the Netrunner stands in the building, the access point has a physical location, and Control Nodes change the room everyone else is standing in.

So build every Architecture around a concrete thing. If nobody outside the NET cares whether the next floor falls, it is not a job scene yet. Put a door, a camera, a drone, an elevator, a sprinkler, a file, or an alarm on the line, let ICE guard it, and let the team decide how long the Netrunner gets to work.

What a Netrunner needs

The Core Rulebook's kit is short. To use a Cyberdeck at all, a character needs Interface Plugs, and Interface Plugs require a Neural Link. Virtuality Goggles project the NET over the real world so the Netrunner can still move and act in Meatspace. Forget them and you netrun the old way, which the book says leaves you effectively Unconscious to the physical world until you Jack Out.

A Netrunner can be plugged into only one Cyberdeck at a time, and switching decks costs a Meat Action. The Cyberdecks guide covers deck quality, hardware, and upgrades in detail.

Not every device has a NET Architecture. The Core Rulebook points out that analog electronics and gear that runs on the CitiNet and memory chips, such as Agents and video cameras, cannot be hacked with Interface. Electronics/Security Tech handles those, and Cybertech handles cyberware. That split gives a Netrunner and a Tech different ways to solve the same job, and it is why many Netrunners also invest in Electronics/Security Tech.

Interface and the net action economy

On each Turn a Netrunner chooses between one Meat Action and a batch of NET Actions. Either way they keep their Move Action, so a common play is to step behind cover while staying within range of the access point, then spend the NET Actions. Interface Rank sets the size of that batch:

Almost everything inside an Architecture costs a NET Action: Jacking In or Out, activating or deactivating a program, and using most Interface Abilities. Two things are free. Moving between floors is not an action, so a Netrunner can descend as far as they like in one Turn until a Password or other obstruction stops them. Saving a copy of a File to the deck is also free.

Interface Abilities resolve as Interface + 1d10 against a DV, with Zap as the exception because it is an opposed attack.

Brain damage from the NET goes straight to HP. Armor does not reduce it, and it cannot cause a Critical Injury.

A NET Architecture, end to end

The Core Rulebook compares a NET Architecture to an elevator. Each floor is a door, and behind it waits a File, a Password, a Control Node, a program, Black ICE, or even another Netrunner. You open every door in order and cannot skip any.

Leaving has real rules behind it. A safe Jack Out resets the Architecture's defenses, so a second attempt starts from the top at the same entry point, and every program leaves with the Netrunner. Walk out of range instead and the connection drops, and the Netrunner suffers the effect of every enemy Black ICE they encountered and did not Derezz.

The other key line is between a temporary advantage and a lasting one. Control of every node ends at Jack Out. The Virus ability is the book's only way to leave a persistent change. The GM sets its DV and how many NET Actions it takes, and the book's own sample Viruses run from 1 NET Action for a cosmetic joke to 10 for wiping every Black ICE in the system.

Building a NET Architecture

A good Architecture is a local security job turned on its side: the crew reaches a physical access point, the Netrunner works down ordered floors, and every useful result changes the place everyone is trying to survive. Build it around a real location and a concrete objective, then keep only the floors, defenses, and Control Nodes that make that objective matter.

Start in meatspace

The Core Rulebook's Architectures are local, and its final build step tells GMs to give every File and Control Node a reason to exist in the location. Answer the physical questions before you place a single floor:

1. What place owns this system?
2. Where is the access point, and why is it hard to reach or hold?
3. What does the crew need the Netrunner to change?
4. Which physical defenses, routes, or secrets connect to that change?
5. What happens if security realizes someone is inside?

Those answers also set the scale. The book's own example is a nightclub that needs a few Control Nodes and an Imp to run sound and lighting, where security may not be a priority. A neighborhood clinic might protect cameras, a records File, and a locked drug cabinet. A corporate lab can justify deeper defenses because the site, the prize, and the response all support them. Do not make a small location feel important by adding arbitrary floors; make its existing security and secrets matter.

Pick a difficulty rating

Step 0 in the Core Rulebook is choosing a Difficulty Rating that challenges the Netrunner without simply killing them. It sets the DV of Passwords, Files, and Control Nodes and tells you which Interface Rank gives a Netrunner a fair chance.

The book recommends Standard as a starting point. The rest of the procedure is short:

• Shape it. Roll 3d6 for the total number of floors. Roll a d10, and on a 7 or higher the Architecture branches; keep rolling until you miss. Nothing branches before the third floor, and the longest branch defines the bottom where a Virus can go.
• Fill it. Roll the first two floors on the Lobby table, which mixes low-DV Files and Passwords with a few Black ICE programs. Roll the rest on the body table for your Difficulty Rating, re-rolling repeat programs and Passwords. The deeper floors are more likely to hold valuable Files and Control Nodes.
• Fit it. Tie each File and Control Node to the location, decide whether a Demon runs the nodes, and swap floors or programs of equal cost to suit the site. You can also hand-pick floors, and occasionally borrow one from the next Difficulty Rating up as a boss floor.

Read the floors as a sequence of decisions

Because the Netrunner cannot skip ahead, the order should escalate the job rather than repeat the same obstacle.

Vary the pace. A Password creates pressure, a camera node opens a route, a File complicates the client's story, and a defender makes the exit urgent. Not every category has to appear. The ordered path should hand the crew new information and sharper choices each time a door opens.

Make control nodes the payoff

Control Nodes connect the Architecture to the room. The Core Rulebook's list runs well past guns: cameras, sprinklers, sirens, conveyor belts, door locks, soda machines, and air conditioning all qualify. Hook nodes to things the crew can see or use right away. Each node can be activated once per Turn, and a Netrunner who wants to take a node held by another Netrunner or a Demon has to beat the Control Check that holder made.

When you place a node, write one line beside it: "What does the crew do if this becomes theirs?" That gives the Netrunner a ready callout:

Control ends when the Netrunner leaves. If the crew wants a deeper change, that means reaching the bottom for a Virus, which costs time and can make the escape more dangerous.

A small build workflow

Use this when preparing an original Architecture instead of rolling one:

1. Name the physical objective. "Get the freight elevator moving" beats "hack the system."
2. Place the access point where the crew must earn it: a guard booth, an office, a basement rack, a roof relay, or a vehicle bay.
3. Pick two or three systems that change the physical plan. A route, a defense, and a secret make a strong starting set.
4. Arrange only the floor elements that create pressure or payoff on the way to those systems.
5. Add a serious defender only when the prize and the location support the escalation.
6. Decide what the owner notices, what the Demon can operate, and what a clean or messy exit changes afterward.

Example: a nightclub's access point sits in a locked manager's office. A Password delays the Netrunner, a File holds the owner's private recordings, a Control Node runs the dance floor cameras and the side exit, and Black ICE stands between the crew and the deeper evidence. The physical team now has reasons to hold the office, use the blind spot, and argue about whether the evidence is worth staying for.

The program toolkit

Programs are the Netrunner's active toolkit. The Core Rulebook sorts non-Black ICE programs into Boosters, Defenders, and Attackers, and every one of them competes with hardware for the same deck slots. A useful first deck answers the threats the GM actually puts in front of the crew, which is rarely the same as the most aggressive loadout.

Each loaded program can be activated only once per Meatspace Round, which is why some Netrunners carry duplicate copies. Installing or uninstalling a program takes an hour, so the loadout is locked in before the job starts. The Netrunning Programs guide covers each class, program tempo, and deck-slot tradeoffs.

Black ICE and demons

Black ICE makes the Netrunner's clock dangerous. A Demon makes the whole building fight back. Use Black ICE to pressure the person inside the NET, and use Demons and Control Nodes to force the rest of the crew to decide how long they can keep the access point secure. Neither should cut the Netrunner off from the table. The best ICE encounter changes the physical job: the team has to hold a corridor, stop a waking drone, choose between extraction and a deeper File, or buy the Netrunner time to leave cleanly.

Three kinds of Black ICE

The Core Rulebook separates Black ICE by what it hunts. Read the category before choosing a response.

The category also sets the story role. Anti-Personnel ICE makes the Netrunner's position risky right away. Anti-Program ICE makes loadout choices matter mid-run; the heavier ones, such as Killer, Sabertooth, and Dragon, destroy a program outright instead of merely Derezzing it. A Demon turns the Architecture into a shared emergency, because its choices show up as moving cameras, sealed doors, armed drones, alarms, and active defenses.

Encounter, pursuit, and tempo

Black ICE usually waits behind a floor's door. When the Netrunner opens it, both sides roll: the Netrunner's Interface plus any active Speed bonus + 1d10 against the ICE's SPD + 1d10. If the ICE wins, its effect lands at once (on a random active program, for Anti-Program ICE). Either way, it then enters the Initiative Queue at the very top and attacks every Turn, rolling ATK + 1d10 against the Netrunner's Interface + 1d10 or a program's DEF + 1d10. It chases its target through the whole Architecture until it is Derezzed or Slid away from. Anti-Program ICE keeps following even when the Netrunner has nothing Rezzed.

At the table, turn that procedure into a visible clock:

1. Name where the access point is and who is protecting it.
2. Say what the Black ICE is costing right now: time, an active program, the Netrunner's safety, or a deeper objective.
3. Give the physical crew a simultaneous response: hold the door, move the client, cut a defense line, create a distraction, or start the extraction.
4. Return to the Netrunner's choice: fight, change tools, try to leave, or accept the risk for a bigger payoff.

That rhythm keeps the threat part of the job. The Netrunner's NET choice changes what the group can risk in Meatspace, and the crew's physical action changes how long the Netrunner has to make it.

Slide is an exit choice

Slide is a NET Action: Interface + 1d10 against the Black ICE's Perception + 1d10. On a success, the Netrunner escapes to an adjacent floor, though not past a Password or other obstruction. The ICE stops following and waits right where the chase ended. Slide can be tried once per Turn, only after the ICE is already a problem, and never against a Demon.

The book's own example shows the catch: a Netrunner Slides away from one Hellhound and lands on a floor with another, and cannot Slide again that Turn. Slide protects the Netrunner and keeps the crew's other plans alive, but it can leave live security between the team and a deeper objective. When a player reaches for it, ask: "What are you giving up by leaving this layer intact?"

Program damage and hard choices

REZ is a program's hit points. A program at 0 REZ is Derezzed: still on the deck and still counted as running, but useless until the Netrunner spends 2 NET Actions to deactivate and reactivate it, which restores full REZ. A Destroyed program is erased and has to be bought again. That gap matters, because one tool can come back mid-run while the other becomes a shopping trip.

Use the consequence that sharpens the job. If Anti-Program ICE threatens the one active tool keeping the exit usable, the crew has a reason to act now. If the Netrunner can accept temporary damage to secure a File, the group has a real risk-reward call. The Backup Drive hardware exists for exactly this fear: it saves non-Black ICE programs that would be destroyed so they can be reinstalled later.

A demon is a building with priorities

Demons are narrow Black ICE intelligent systems, not the restricted True AIs of the pre-War NET. The Core Rulebook lists three, the Imp, Efreet, and Balron, with more REZ, Interface, and NET Actions as they scale up. A Demon:

• can use only two Interface Abilities: Zap to defend itself and Control to run nodes;
• cannot run programs or Black ICE;
• knows everything in its Architecture, so Passwords do not slow it, it always knows a Netrunner is present, and it wins any Speed contest against a program;
• has no SPD or PER, so it cannot be Slid away from and gets no free hit on discovery;
• joins the top of the Initiative Queue when a camera spots an intruder or a Netrunner enters;
• spends its NET Actions on Control Node triggers first and Zaps the Netrunner only with what is left.

Active Defenses such as drones need a Demon or a Netrunner on their Control Node to stay operational. Emplaced Defenses such as turrets can fire on their own. The book tells GMs to fit the Demon to the site: Imps are common, and a local movie theater probably is not running a Balron unless it is hiding something.

Write each Demon as a short procedure rather than a personality:

The book's own illustration of a Demon's limits is a turret that shoots anyone without the right ID badge. If the wrong person carries the badge, the Demon follows the trigger anyway. Give it the response the place was built to make, not every response it could make.

Black ICE or demon: pick the pressure

Use Black ICE when the question is "Can the Netrunner keep moving?" Use a Demon when the question is "Can the crew stay alive while the building fights back?" A Demon that seizes a camera, drone, or turret gives the rest of the table a direct reason to act while the Netrunner contests the Architecture. Keep the table-facing description simple: say what the security protects, say what it is doing in Meatspace, and pass attention to the next player who has to respond.

Running your own Black ICE

A Netrunner can load their own non-Demon Black ICE into a Cyberdeck, where each one takes 2 slots. Demons are too big for a deck. Activating player-owned ICE is a NET Action, and it works one of two ways: set it to lie in wait on the current floor (not possible during combat), or aim it at a valid target in combat, where it enters the top of the Initiative Queue and attacks each Turn. Retargeting it costs a deactivate and a reactivate. The book is blunt that Black ICE is not a digital pet; it does the one thing it was coded to do.

That makes owned ICE a commitment. It can answer the kind of opponent a campaign keeps throwing at the crew, but it crowds out programs and hardware that solve other problems. Read the Cyberdecks guide before spending the space, and tell the crew what opening the choice is meant to create.

Keep the whole table in the scene

Use this pattern to keep a netrun moving at table speed:

1. State the physical objective before anyone Jacks In: open the security door, stop the camera feed, extract the File, disable a drone, or change the elevator route.
2. Give the Netrunner a visible access point and the rest of the crew an immediate reason to reach or hold it.
3. Put at least one Control Node or File in the Architecture that changes the physical plan when found.
4. On each NET Turn, say what changed in Meatspace before moving to the next player.
5. Let the non-Netrunners create time, cover, distraction, intel, or an alternate route instead of waiting for the run to end.
6. Decide whether the crew needs a temporary opening or has time to reach the bottom and leave a Virus.

Everyone gets a role. The Solo holds the access point. The Fixer redirects a guard. The Tech deals with the camera or Agent that has no Architecture to hack. The Media decides whether the File is a story worth running. The run works when each player gains a new problem or opening, and it stalls when the Netrunner quietly clears a list while the others watch. The Netrunner Role guide covers the player side of those callouts.

What the Netrunning deck adds

R. Talsorian's Netrunning Deck instructions page describes the deck through its Program, Black ICE, Demon, and Floor cards and links a PDF on how the studio uses them. The cards let you lay an Architecture out on the table, fill a Cyberdeck at a glance, and track which program, ICE, Demon, or floor is in play.

Pick it up when your group loses track of the elevator mid-run or when a GM wants to assemble an Architecture quickly. Skip it if a written map or digital notes already keep the scene clear. It buys clarity; the rules still come from the Core Rulebook.

Gear choices: add options with a purpose

The Core Rulebook sets the baseline: a Poor Quality Cyberdeck (100eb, 5 slots), a standard Cyberdeck (500eb, 7 slots), and an Excellent Quality Cyberdeck (1,000eb, 9 slots). It also offers a Cyberarm-installed Cyberdeck that adds 1 program-or-hardware slot and a Bodyweight Suit that adds 1 hardware-only slot. Black Chrome adds more, including an upgrade that gives an already Cyberarm-integrated Cyberdeck one more slot for programs or hardware. Every added slot should support the kind of runs your campaign actually has.

If your group does not yet run NET Architectures regularly, do not buy gear for a problem the campaign has not created. If runs are already a recurring part of the job, use the Cyberpunk RED Sourcebooks Guide to decide whether Black Chrome is the right purchase, and the Gear Guide for how Night Market access shapes what the crew can find.

Where to go next

• Return to the Cyberpunk RED Guide Hub for the complete library map.
• Read the Cyberpunk RED Netrunner Role guide for Interface, first deck decisions, and crew coordination.
• Use the Netrunning Programs guide for Boosters, Defenders, Attackers, and program tempo.
• Use the Cyberdecks guide for capacity, hardware tradeoffs, and upgrades.
• Read the Cyberpunk RED Roles Guide for the Netrunner's place among the other nine Roles.
• Use the Cyberpunk RED Beginner's Guide when your group is still choosing a first-session path.
• Read Cyberpunk RED versus Shadowrun before comparing RED's job-site netrunning with a cyberpunk-fantasy Matrix.
• Browse the Cyberpunk RED guide directory for every live guide.

Sources and scope

This guide summarizes the Netrunning chapter of the Cyberpunk RED Core Rulebook: required gear, Cyberdeck slots and prices, Interface Abilities and NET Actions, Jacking In and Out, NET Architecture construction and Difficulty Ratings, Black ICE classes, encounters, Slide, Demons, Control Nodes, and player-owned Black ICE. It also draws on the official Netrunning Deck instructions page and the Integrated Cyberdeck Upgrade in Black Chrome. It does not reproduce the program and Black ICE stat tables, the Lobby and floor tables, Demon statistics, defense tables, or card text. Use those products for exact values and effects.