# Cyberpunk RED ICE Guide: Make NET Combat Matter In Meatspace > Understand Cyberpunk RED Black ICE, Demons, pursuit, Slide, program damage, and the physical consequences that keep NET combat part of the crew job. Source: https://theroleplayersguild.com/articles/cyberpunk-red/netrunning-guides/cpr-ice-guide Published: 2026-08-01 Updated: 2026-08-01 Author: Andrew Blase Site: The Role Players Guild --- *[Cyberpunk RED Guide Hub](/articles/cyberpunk-red) | [Netrunning Guide](/articles/cyberpunk-red/netrunning-guides) | [NET Architecture Guide](/articles/cyberpunk-red/netrunning-guides/cpr-net-architecture-guide) | [Netrunner Role Guide](/articles/cyberpunk-red/role-guides/cpr-netrunner-guide) | [Cyberpunk RED Guides](/guides/cyberpunk-red)* ## The Short Answer **Black ICE is the part of a Cyberpunk RED NET Architecture that makes the Netrunner's clock dangerous. A Demon is the part that can make the whole building fight back.** Use Black ICE to pressure the person inside the NET; use Demons and Control Nodes to make the rest of the crew decide how long they can keep the access point secure. Neither is a reason to isolate a Netrunner at the table. The best ICE encounter changes a physical job: the team must hold a corridor, stop a waking drone, choose between extraction and a deeper file, or buy enough time for the Netrunner to escape cleanly. ![An original Netrunner faces an abstract hostile security construct in a flooded dense industrial server corridor while the crew protects the access point](hero.webp) ## Hot Take Black ICE should almost never be the most interesting thing in its own fight. It is dangerous because of what it delays, protects, or forces the crew to abandon. If the only consequence of ICE is another private exchange of NET attacks, it has become scenery. Put a door, a client, an alarm, a drone, or an expiring escape route on the other side of the next decision. ## Three Kinds Of Black ICE The Core Rulebook separates Black ICE by the kind of pressure it creates. Read the category before choosing a response. | Type | What it threatens | The crew-facing question | | --- | --- | --- | | Anti-Personnel Black ICE | The Netrunner directly. | Can the team create enough time and safety for the Netrunner to keep working or get out? | | Anti-Program Black ICE | The Netrunner's active programs. | Which active tool cannot the current plan afford to lose? | | Demon | The Architecture's Control Nodes and the physical systems they operate. | What does the crew do when the site turns its own defenses against them? | The category tells the story role, not just the target. Anti-Personnel pressure makes the Netrunner's position immediately risky. Anti-Program pressure makes loadout choices matter in the middle of the run. A Demon makes an Architecture a shared emergency because its choices can appear as moving cameras, sealed doors, armed drones, alarms, or active defenses. ## Encounter, Pursuit, And Tempo Black ICE can wait inside an Architecture and become active when the Netrunner encounters it. The Core Rulebook resolves that first contact with a speed contest, then puts the Black ICE into the NET combat order if it engages. From there, it acts every turn until it is defeated or escapes its target through the appropriate rule. For the table, translate that procedure into a visible clock: 1. Name the physical location of the access point and the crew member protecting it. 2. Say what the Black ICE is costing right now: time, an active program, the Netrunner's safety, or a deeper objective. 3. Give the physical crew a simultaneous response: hold the door, move the client, cut a defense line, create a distraction, or begin extraction. 4. Return to the Netrunner's choice: fight, change tools, try to leave, or accept the risk for a more valuable result. That rhythm keeps the threat from becoming a separate minigame. The Netrunner's NET decision changes what the group can risk in Meatspace, while the crew's physical action changes how long the Netrunner has to make it. ## Slide Is An Exit Choice, Not A Shortcut Slide lets a Netrunner attempt to escape a non-Demon Black ICE program after the threat is already present. A successful escape does not erase the threat from the Architecture; it leaves it behind at the point where the Netrunner escaped. Slide cannot be used preemptively, and it does not work against a Demon. That makes Slide a useful story decision. It can protect the Netrunner and preserve the crew's chance to finish another part of the job, but it can also leave a problem between the team and a deeper objective. When a player chooses it, ask: "What are you giving up by leaving this security layer intact?" ## Programs, Damage, And Hard Choices Black ICE can put direct pressure on the Netrunner or on their active programs. The Core Rulebook uses REZ for program durability and distinguishes a Derezzed program from one that is destroyed. That difference matters because an active tool might be recoverable after the run, while a destroyed tool creates a longer-term replacement problem. Use the consequence that makes the job sharper. If Anti-Program Black ICE threatens the one active tool that keeps the exit usable, the crew has a reason to act now. If the Netrunner can accept temporary program damage to secure a file, the group has a meaningful risk-reward decision. The [Netrunning Programs Guide](/articles/cyberpunk-red/netrunning-guides/cpr-netrunning-programs-guide) explains the normal program categories, activation, and recovery context. ## A Demon Is A Building With Priorities Demons are specific intelligent Black ICE systems, not the unrestricted true AIs of the pre-War NET. They use Control Nodes and a limited set of NET abilities to defend an Architecture and the physical location tied to it. They are constantly aware inside their own Architecture, cannot be bypassed with Slide, and prioritize their control triggers before using remaining actions to target the Netrunner. For GMs, write the Demon as a short procedure rather than a personality: | Trigger | Control Node response | What the crew sees | | --- | --- | --- | | An unrecognized person enters the service hall. | Camera identifies the intruder and door locks engage. | The route closes and the crew must move or force entry. | | A Netrunner enters the Architecture. | A drone moves toward the access point. | The team has a physical countdown while the Netrunner works. | | The crew reaches a protected room. | A turret or other active defense comes online. | Someone outside the NET must create cover, disable it, or change the plan. | Match each trigger to the location. A small venue might have cameras, doors, lights, and an ordinary low-level defender. A hardened facility can support more serious defenses because the prize, owner, and physical security justify the escalation. Do not give a Demon a dramatic response just because it is available; give it the response the place was built to make. ## Running Your Own Black ICE The Core Rulebook also permits a Netrunner to load non-Demon Black ICE into a Cyberdeck. It uses more deck capacity than a normal program and remains narrow in purpose: it is not a general digital companion. A Netrunner can set it to wait or direct it at a valid target under the book's NET rules, but must manage it deliberately. That makes player-owned Black ICE a commitment. It can be a strong answer to the kind of opponent a campaign actually features, but it competes with programs and hardware that could solve a different problem. Read the [Cyberdecks Guide](/articles/cyberpunk-red/netrunning-guides/cpr-cyberdecks-guide) before spending that capacity, then make sure the crew knows what opening the choice is meant to create. ## Where To Go Next Use the [NET Architecture Guide](/articles/cyberpunk-red/netrunning-guides/cpr-net-architecture-guide) to build the access point, floors, Control Nodes, and Meatspace stakes that make ICE matter. Read the [Netrunner Role Guide](/articles/cyberpunk-red/role-guides/cpr-netrunner-guide) for Interface, crew coordination, and purposeful deck choices. Return to the [Netrunning Guide](/articles/cyberpunk-red/netrunning-guides), [Cyberpunk RED Guide Hub](/articles/cyberpunk-red), or [guide directory](/guides/cyberpunk-red) for the live library. Use the Core Rulebook for exact Black ICE statistics, costs, effects, encounter checks, Demon statistics, Control Node rules, and NET combat procedures. ## Sources And Scope This guide summarizes Black ICE categories, encounter and pursuit concepts, Slide, program damage context, Demons, Control Nodes, and player-owned Black ICE from the *Cyberpunk RED Core Rulebook*. It does not reproduce Black ICE tables, costs, statistics, exact effects, Demon statistics, encounter formulas, or full NET combat procedures. Use the Core Rulebook for exact rules and values.