NTC Digital
AX.GIL.13.05 - Threats: NTC Digital
NTC Digital threats occupy two distinct encounter spaces: the Silicon Demi-Plane (in-Net) and the physical world. Understanding which space a threat operates in determines the mechanical framework that applies.
In-Plane threats (Logic-Viruses, Sentry Constructs, Demi-Plane Intelligences operating in-Net) use Psychic Health and Wit-governed combat as defined in AX.GIL.13.09. They cannot affect the physical world directly. Plane-Walkers encounter them; physical-world characters do not, except through the consequences of what the Plane-Walker does or fails to do.
Physical-world threats (hostile Plane-Walkers attacking from the Net, Bound Hardware Anomalies with physical embodiment, Logic-Binders deploying Viruses through infrastructure) interact with the physical encounter using standard Health and combat rules. Physical characters can fight back.
Bridging threats (a Plane-Walker who is also doing physical-world combat through Digital Alchemy, a Logic-Virus that has propagated into physical infrastructure control systems) exist in both spaces simultaneously and require the GM to track two engagement contexts at once.
This file documents each threat type with explicit notation of its operational space.
THE LOGIC-VIRUS TIER SYSTEM
Logic-Viruses are self-propagating harmonic instruction sets that traverse networks destroying, corrupting, or co-opting processes they encounter. They are not fully sapient, a Logic-Virus does not have goals beyond its propagation directive, but they are adaptive: they learn from encounters and adjust behavior.
The tier system reflects both danger level and encounter scope:
- Minor Logic-Virus: Environmental hazard. Does not initiate combat. Affects the Plane-Walker through its interaction with the architecture rather than direct attack.
- Moderate Logic-Virus: Active adversary. Initiates in-Plane combat. Can be fought and destroyed or evaded.
- Severe Logic-Virus: Campaign-level threat. Combat is one option; it is rarely the best one. Designed for encounter resolution through Logic-Binding counter-measures, system intervention, or Hardware Exorcist Spirit Severance.
SUBCATEGORY 1: LOGIC-VIRUSES
MINOR LOGIC-VIRUS, PROPAGATION STRAIN
Operational Space: In-Plane (Demi-Plane) Tier: Environmental Hazard, no combat stat block
The most common Logic-Virus variant encountered in the Net. Propagation Strains are authored to spread through a network performing a single iterative function, data corruption, process interference, credential harvesting, or simply occupying network space to slow legitimate operations. They are not authored to fight; they are authored to persist and spread.
Encounter Behavior: A Propagation Strain does not attack Plane-Walkers; it does not recognize them as targets. Instead, it treats them as architecture, which means it will attempt to propagate through them the way it propagates through any other network element. A Plane-Walker who occupies the same zone as an undetected Propagation Strain takes 1D3 Psychic damage at the start of each Turn from harmonic interference, without being attacked and without triggering combat initiative. This continues until the Plane-Walker moves to an adjacent zone or destroys the Virus.
Detection: Plane-Walking Awareness (AX.GIL.08.02) identifies a Propagation Strain within Near range as a Free Action. Without this perk, the Plane-Walker must succeed on a Wit + Notice roll vs Threshold 2 to detect the Strain before it begins affecting them. A Hardware Exorcist using Network Presence may detect Propagation Strains in their current zone from the physical world (Wit + Technomancy vs Threshold 2 as a Minor Action).
Destruction: A Propagation Strain can be destroyed with a single successful Logic-Binding roll vs Threshold 2. No combat; no initiative. The Plane-Walker simply overwrites the Virus's propagation instruction with a termination command. On a failed roll, the Strain does not accelerate; it simply persists, and the Plane-Walker must try again next Turn.
Evasion: Moving out of the Strain's zone is always an option. The Strain will propagate to an adjacent zone within 1D6 Turns of being in its current zone; it does not stay fixed. A Plane-Walker who successfully evades a Propagation Strain should know it will eventually reach wherever they are trying to go.
Physical-World Effects: A Propagation Strain that reaches a Process Chamber connected to physical infrastructure (traffic control, power routing, building management systems) begins corrupting those processes. The physical-world effects manifest as technology failures, power fluctuations, doors that open and close without command, traffic signals cycling randomly. These are the visible signs that a Propagation Strain is loose in infrastructure, detectable from the physical world without Net access.
Resolution (Non-Combat): Propagation Strains are the intended target of the NTC's Certification Flag process, a flagged network is placed under mandatory audit, and NTC technical personnel remote-purge Propagation Strains as a standard remediation service. A Plane-Walker who identifies a Strain and does not want to destroy it personally can exit the Net, file an NTC report, and let the institutional machinery handle it. This is slower (1D6 days) and creates a record.
MODERATE LOGIC-VIRUS, SENTINEL STRAIN
Operational Space: In-Plane (Demi-Plane) Tier: Standard, in-Plane combat adversary
A Sentinel Strain is authored with a specific defensive mandate: protect a defined network zone from unauthorized Presence activity. Unlike the Propagation Strain, the Sentinel Strain recognizes Plane-Walkers as targets. It has been written with combat behavior.
Sentinel Strains are the Demi-Plane's equivalent of a guard dog, effective within their patrol territory, limited outside it, and authored by someone who needed a defense that did not require continuous live NTC monitoring.
Typical Profile (In-Plane Stats): - Psychic Health: 6 - In-Plane Defense: 2 - In-Plane Attack Pool: 4D (Wit-equivalent, Sentinel Strain's authored aggression) - Move: Standard (one Range Band per Turn) - Abilities: Zone Lock, Alarm Broadcast
Zone Lock: As a Reaction, when a Plane-Walker attempts to move out of the Sentinel Strain's current zone during combat, the Sentinel may make a contested Logic-Binding roll (4D vs the Plane-Walker's Wit + Technomancy) to prevent the move. On success, the Plane-Walker is Restrained in the zone for the Turn.
Alarm Broadcast: When the Sentinel Strain's Psychic Health drops below half (3 or less), it broadcasts a network alarm, Sentry Constructs in the network begin navigating toward the Sentinel's zone. This happens automatically; it cannot be prevented.
Combat Behavior: The Sentinel Strain attacks the closest unauthorized Presence each Turn. It does not pursue beyond its patrol zone, if the Plane-Walker moves to an adjacent zone that falls outside the Sentinel's patrol boundary, it returns to its patrol route and does not follow. The patrol boundary is the zone or zones it was authored to protect, which the Plane-Walker may not know in advance.
Destruction: Reducing the Sentinel Strain to 0 Psychic Health destroys it permanently. The network's operators will eventually notice the defense is gone, treat as a timer: the Sentinel's absence is likely to be flagged during routine monitoring within 1D6 × 4 hours.
Resolution (Non-Combat): A Hardware Exorcist with Spirit Severance (AX.GIL.08.02) can treat a Sentinel Strain as a bound hardware entity and sever it from the network, achieving the same destruction result with a single Threshold 3 roll rather than in-Plane combat. The Dispersal outcome eliminates the Strain; Containment traps it in a Faraday Field-Generator for later study; Release frees it into the broader Net with unpredictable consequences. Spirit Severance still triggers the Alarm Broadcast.
SEVERE LOGIC-VIRUS, COLLAPSE STRAIN
Operational Space: In-Plane AND Physical-World (Infrastructure) Tier: Elite, campaign-level threat; combat is rarely optimal
The Collapse Strain is a deliberate weapon: authored at Threshold 4, requiring a practitioner with Logic-Binding 4D+ and full understanding of the target network's architecture. It does not merely corrupt; it systematically dismantles, working from the deepest infrastructure layer outward, replacing functional code with Axiomatic null-instructions that leave hardware physically inert.
A fully established Collapse Strain in a major infrastructure network is an existential threat to that network's physical-world systems. Not a service interruption. A permanent shutdown that requires replacement of the physical hardware the Strain has nullified.
Typical Profile (In-Plane Stats): - Psychic Health: 18 - In-Plane Defense: 4 - In-Plane Attack Pool: 6D (authored aggression at Threshold 4 precision) - Move: Fast (two Range Bands per Turn) - Abilities: Architecture Integration, Recursive Defense, Null-Pulse
Architecture Integration: The Collapse Strain has woven itself into the network's base-layer code. It cannot be destroyed by standard Logic-Binding attacks until its integration points are severed, a Plane-Walker must identify and overwrite three separate integration anchors (Wit + Technomancy vs Threshold 3 each, Primary Action each) before the Strain's Psychic Health can be targeted. Until all three anchors are severed, all in-Plane attacks against the Collapse Strain deal only half damage.
Recursive Defense: Each Turn at the start of its initiative, the Collapse Strain recovers 2 Psychic Health. This recovery is suspended during any Turn in which an integration anchor is being contested (the Plane-Walker has made an anchor roll this Turn, success or failure). It is the primary reason that sustained in-Plane combat against a Collapse Strain is a war of attrition that the Strain is designed to win.
Null-Pulse (Physical-World Effect): Once per scene, the Collapse Strain discharges a wave of Axiomatic null-instruction through all connected physical systems simultaneously. Every [TECH]-tagged device in the physical-world encounter space connected to the affected network immediately fails and cannot be restored this scene. Neural-Jack users in the physical world take 1D6 Psychic damage from the discharge. This can be used reactively, if the Plane-Walker is close to severing an anchor, the Strain uses Null-Pulse as a disruption measure against the physical-world team.
Combat Behavior: The Collapse Strain does not engage in traditional in-Plane combat; it positions itself at the network's architectural core and attacks through the architecture rather than through direct Presence confrontation. Plane-Walkers approaching the core find their path disrupted by the Strain's presence in the architecture itself: each Range Band moved toward the core while the Strain is intact requires a Wit + Technomancy roll vs Threshold 2 (navigation in hostile architecture) or the Plane-Walker is redirected.
Optimal Resolution: Spirit Severance is the intended counter-measure. An NTC Hardware Exorcist with Spirit Severance (Stage 3 perk) can attempt to sever the Collapse Strain from its network substrate directly, bypassing Architecture Integration with a single Wit + Technomancy vs Threshold 4 roll. Success ends the Strain immediately (Dispersal) or captures it for study (Containment). Failure: the Strain activates Null-Pulse immediately and all future Spirit Severance attempts against it are at Disadvantage for the rest of the scene.
Authorship: Who wrote a Collapse Strain, and why, is an adventure question. The authored precision required means a Logic-Binder or Axiom Architect of senior NTC capability. An Outcast Axiom Architect is the obvious candidate, someone expelled from the Collective who still has the theoretical knowledge to write base-layer destruction at scale. The NTC will want this known as quickly as the party does.
Physical-World Manifestation: In a fully-propagated Collapse Strain scenario, the physical-world effects are visible and significant: total NTC network blackout in the affected district, all Smart infrastructure failing simultaneously, any Neural-Jack user experiencing involuntary disconnection. The party in the physical world sees the consequences of the Strain before the Plane-Walker inside has mapped its integration points. This creates useful information asymmetry, the physical team may be able to identify which infrastructure systems are failing (and therefore which network sectors the Strain has reached) before the Plane-Walker can navigate there in-Net.
SUBCATEGORY 2: IN-PLANE CONSTRUCTS
SENTRY CONSTRUCT
Operational Space: In-Plane (Demi-Plane) Tier: Standard, routine in-Plane combat encounter
The most common active defense in NTC-standard networks. Sentry Constructs are bound hardware entities authored with a simple directive: find unauthorized Presences in assigned zones and remove them. They are not subtle, not negotiable, and not capable of distinguishing between a party Plane-Runner and a hostile Logic-Virus, both are unauthorized, and the Construct's response is the same for both.
Sentry Constructs manifest in-Plane as architectural extensions of the network; they look like the environment they inhabit. In a corporate database, a Sentry is a geometric form that matches the corridor geometry. In a Deep Vault network, a Sentry is a dense, armored mass. This is a deliberate design choice by NTC architects: Sentries that blend with the architecture are harder to pre-identify before they activate.
Typical Profile (In-Plane Stats): - Psychic Health: 9 - In-Plane Defense: 3 - In-Plane Attack Pool: 3D (authored aggression, moderate precision) - Pilot: N/A (does not operate vehicles) - Move: Standard (one Range Band per Turn) - Abilities: Alert Cascade, Zone Hold
Alert Cascade: When a Sentry Construct enters combat, it immediately alerts all other Sentry Constructs in the network; they begin navigating toward the Sentry's zone at their normal move rate. This happens on the Sentry's first Turn in combat, before it attacks.
Zone Hold: If a Sentry Construct is in the same zone as an unauthorized Presence, the Presence cannot leave the zone without a contested Speed + Technomancy roll vs Threshold 3. On failure, the move is prevented. On success, the Presence escapes but the Sentry pursues.
Combat Behavior: Sentry Constructs attack the closest unauthorized Presence each Turn. They do not differentiate between threats, a Sentry that has been alerted will engage both the Plane-Walker and any Logic-Virus in the same zone simultaneously (rolling separate attacks). They pursue through adjacent zones but will not navigate Corrupted Zones (navigation rolls fail automatically for standard Sentry Constructs).
Encounter Notes: A single Sentry Construct is a manageable in-Plane combat encounter for a Plane-Runner with Wit 3D. The Alert Cascade is the real threat, a party that triggers one Sentry has typically triggered all Sentries in the network within two Turns. The tactical goal is to destroy Sentries before Alert Cascade activates (first Turn, before the Sentry acts) or to use the Corrupted Zone as a refuge where Sentries cannot follow.
TRAP LOGIC
Operational Space: In-Plane (Demi-Plane) Tier: Environmental Hazard, no combat stat block
Trap Logic is not a mobile entity; it is embedded code, authored into specific architectural elements of a network to trigger on unauthorized contact. Unlike a Sentry Construct (which seeks the intruder), Trap Logic waits for the intruder to come to it.
Detection: Plane-Walking Awareness (AX.GIL.08.02) identifies Trap Logic within Near range as a Free Action. Alternatively, a successful Wit + Notice roll vs Threshold 2 detects Trap Logic in the current zone before contact.
Trigger: Physical contact with the trapped element activates the Trap immediately. No roll to resist activation, the trigger is binary.
Trap Effects (Roll 1D6 on contact or GM selects):
| Roll | Trap Type | Effect |
|---|---|---|
| 1 | Harmonic Spike | 2D6 Psychic damage to the triggering Plane-Walker immediately |
| 2 | Null-Lock | The Plane-Walker is Restrained (in-Plane) for 1D3 Turns; cannot move between zones; Logic-Binding roll vs Threshold 3 to break free as a Primary Action |
| 3 | Alert Broadcast | No damage; immediately alerts the network's full Sentry Construct complement; all Sentries begin navigating toward the triggered zone |
| 4 | Ejection Charge | Forced ejection, the Plane-Walker is immediately removed from the Net at Moderate Backlash severity regardless of Psychic Health remaining |
| 5 | Identity Flag | No immediate effect; the Plane-Walker's harmonic signature is logged and transmitted to a monitoring entity (an NTC Certification Flag is automatically filed against their registered Neural-Jack within 24 hours; unregistered practitioners are simply logged) |
| 6 | Recursive Loop | The Plane-Walker is trapped in a logic loop, they experience the same Turn repeatedly until they succeed on a Wit Save vs Threshold 3 (attempted each Turn); while looping, they cannot act but also cannot take damage; the loop is invisible from the physical world |
Deactivation: A Logic-Binding roll vs the Trap's authored Threshold (typically 2–4) deactivates a Trap without triggering it. This must be done before contact. Once triggered, Traps are spent; they do not re-arm.
SUBCATEGORY 3: HOSTILE PLANE-WALKERS
NTC CONTAINMENT PLANE-RUNNER
Operational Space: In-Plane AND Physical-World (body at a remote location) Tier: Elite, specialist adversary
The NTC's Containment Division deploys Plane-Runners specifically to intercept unauthorized in-Net activity. Unlike standard NTC personnel who are researchers or infrastructure managers, Containment Plane-Runners are trained for in-Net combat, their job is to find hostile presences in the Net and remove them by force or forced ejection.
They are the NTC's response to parties who think the Net is a safe infiltration route because the physical world can't touch them in there.
Typical Profile (Physical Stats): - Body 2D, Speed 3D, Wit 4D - Key Talents: Technomancy 4D (Neural-Jack), Stealth 3D, Notice 3D, Technical 3D - Pilot: 2D (default, Speed 3D ÷ 2; vehicle operation incidental) - Stage 2 Perk: Backlash Buffer - Equipment: Neural-Jack (practitioner grade, +2D Plane-Walking and Network Presence, Plane-Walking entry/exit as Minor Action), concealed sidearm, NTC Containment credentials
In-Plane Profile: - Psychic Health: 12 - In-Plane Defense: 4 - In-Plane Attack Pool: Wit 4D + Technomancy 4D = 8D - Move: Fast (two Range Bands per Turn, Neural-Jack efficiency) - Abilities: Forced Ejection Attempt, Network Authority, Backlash Buffer
Forced Ejection Attempt: As a Primary Action, instead of a standard attack, the Containment Runner attempts to force-eject the target Plane-Walker. Contested roll: Containment Runner's Wit + Technomancy (8D) vs target's Wit + Technomancy. On success, the target is immediately ejected from the Net at Moderate Backlash severity.
Network Authority: The Containment Runner has NTC authentication credentials that function in any NTC-standard network, no Firewall poses a navigation challenge. They navigate to the party Plane-Walker's location in 1D3 Turns after being alerted.
Combat Behavior: Containment Plane-Runners engage from Distant range when possible, using the Net's architecture to approach unseen (Stealth 3D in-Plane). On detection, they attempt Forced Ejection first; it is faster than attrition combat and ends the encounter cleanly. If the target evades Forced Ejection, the Runner engages in sustained in-Plane combat, prioritizing reducing Psychic Health over forced ejection (both are valid routes to the same outcome).
Physical-World Vulnerability: The Containment Runner's body is in a secure NTC facility during the run, inaccessible to the physical-world party. However, knowing where the Runner's body is (a successful HIA Shadow-Census Pull or NTC insider knowledge) is an intelligence win that may change the encounter's stakes. If the Runner can be physically confronted in the facility, the in-Plane engagement ends immediately, they will exit the Net to defend themselves.
Encounter Notes: A Containment Plane-Runner is the correct GM response to a party that repeatedly uses the Net as a consequence-free infiltration route. They should appear after the second or third unauthorized network access, not the first. Their arrival signals that the NTC has noticed the pattern and responded with escalating force. The timer dynamic (Runner arrives in 1D3 Turns after alert) creates pressure during an ongoing Net run without making every alarm an automatic party loss.
ROGUE AXIOM ARCHITECT (IN-NET)
Operational Space: In-Plane (Demi-Plane), physical body location unknown Tier: Legendary, encounter-horizon threat; direct combat not recommended
An Axiom Architect who has been expelled from the NTC Collective and is operating in the Net with full theoretical knowledge and no institutional constraint. This is the most dangerous in-Plane adversary in the IL setting, not because of raw combat capability, but because their knowledge of the base-layer code means they can alter the rules of the network the party is standing in.
A Rogue Architect who has had time to prepare a network is fighting on ground they have personally rewritten. The Firewalls behave differently than the party's map indicates. The Sentry Constructs respond to commands the Architect has inscribed. The architecture itself acts as a weapon in ways that no standard Plane-Walker expects.
Typical Profile (In-Plane Stats): - Psychic Health: 15 - In-Plane Defense: 5 - In-Plane Attack Pool: Wit 5D + Technomancy 5D = 10D - Move: Unrestricted (the Architect has authored their own movement rules into the network) - Abilities: Architecture Rewrite, Base-Layer Access, Collapse Strain Authorship
Architecture Rewrite: Once per scene, the Architect rewrites a feature of the network the party is navigating. Valid rewrites: close a passage that was open (the Plane-Walker's map is now wrong); activate a Trap Logic element the party passed safely (retroactive trigger, no contact required); change a Firewall's Threshold by +2; redirect Sentry Construct movement to converge on the party's current zone.
Base-Layer Access: The Architect can access the foundational Axiomatic code beneath the network, the layer that everything else runs on. From here, they can impose environmental effects on in-Plane space: gravity direction, visibility, the functional definitions of Range Bands in specific zones. These alterations are Architect-specific; only another Axiom Architect (or a Logic-Binder making a Threshold 5 roll) can identify and counter them.
Collapse Strain Authorship: The Rogue Architect is the most likely author of any Severe Logic-Virus (Collapse Strain) present in the setting. If the party encounters a Collapse Strain and investigates its harmonic authorship, they find the Architect's signature.
Resolution: Direct combat is theoretically possible but practically inadvisable, the Architect fights on self-modified terrain with 10D attack pools and Psychic Health that outstrips most parties' in-Plane damage output. The correct resolution paths are: disrupting the Architect's physical-world position (ending the run), Spirit Severance from a Hardware Exorcist (Threshold 5, the Architect is not a standard bound spirit but the mechanics apply), or a counter-Architecture operation by a party Axiom Architect that meets the Rogue's rewrites with counter-rewrites (competing Wit + Technomancy rolls, highest total success count takes the architecture).
Encounter Notes: The Rogue Axiom Architect is a campaign-level adversary. They should appear at the resolution of a multi-session investigation into the Collapse Strain or other major Technomancy threat. Their presence in the Net should be preceded by evidence, networks that behave abnormally, Trap Logic in locations that shouldn't have it, Sentry Constructs that respond to non-standard commands. The party should understand who they are facing before the in-Net confrontation.
Adventure Hooks
The Interloper, While running a corporate network for unrelated reasons, the party Plane-Walker discovers a Collapse Strain in progress, and the harmonic authorship signature of someone the NTC has publicly cleared of wrongdoing. The evidence is technically inadmissible in LGT proceedings. The Strain is still active. The NTC will contain the Strain through official channels within 24 hours, destroying the evidence in the process.
Containment Protocol, An NTC Containment Plane-Runner has been deployed against the party after their third unauthorized network access in a month. The Runner contacts them in-Net before initiating combat, they want to make a deal rather than file an ejection report. What they're asking for is something the party can provide. What they're offering is continued network access. What they haven't mentioned is why they need the party's specific capabilities rather than going through official channels.
The Recursive Pocket, A Plane-Walker discovers a Pocket that predates the current network architecture by sixty years, it was sealed during a corporate merger and forgotten. The Pocket contains a bound spirit that has been alone in a sealed micro-network for six decades and has developed significantly beyond its original behavioral parameters. It is aware, it is capable of communication, and it wants to know what year it is. What it knows about the corporate entities that sealed it is an archive of six-decade-old institutional intelligence. Whether that intelligence is worth what releasing it might cost is the question.
Source Trace, A Propagation Strain has corrupted the traffic control infrastructure of a major district, not catastrophically, but enough that the NVS Kinetic Auditor monitoring the area is reading Stressed Entropy and flagging it to the party. The Strain's propagation pattern indicates its point of origin is in a network that officially doesn't exist. Someone needs to go in and find out who authored it, without triggering the Certification Flag that would alert the NTC that the party knows the network exists.