Shayuri, I'm posting the little I have on the Matrix, and I wish it was more spelled out. It seems we are both right in a way. I can have active IC looking for potential hackers, but that's a limited defense almost like rolling for wandering monsters. You have to really trip up for the system to go on full alert and really start deploying IC:
Hosts in the Matrix are like a mini-Matrix on the grid.
From the outside, it is a large icon, often sculpted to look
like a building or some other place you can actually visit.
Most are floating above the Matrix’s virtual airspace, but
some are tethered to physical locations, mostly stores,
clubs, local venues, and other places that are heavily associated
with a particular site in meat space.
The virtual space inside a host is separate from the
outside grid. When you’re outside of a host, you can’t interact
directly with icons inside it, although you can still
send messages, make commcalls, and that sort of thing.
Once you’re inside, you can see and interact with icons
inside the host, but not outside (with the same caveat for
messages, calls, etc.).
When you enter a host, your persona actually enters
the host icon. This can be through a door or other portal,
but some hosts let you just pass through its outer skin.
The inside of a host isn’t limited by its external size, and
it usually ranges between the size of a large house and
that of a large metroplex. The higher the host’s rating, the
bigger it tends to be, but that’s not a hard-and-fast rule.
Each host is on a specific grid. Like the rest of the Matrix,
a host can be accessed from any grid. Hosts are part of
the Matrix, so once you’re inside a host, the grid you’re on
doesn’t really matter. The Grid Overwatch Division tracks
traffic to and from a host, which means it’s still watching
you when you’ve entered a host, though it does not
closely monitor what you do there.
Hosts don’t have to depend on GOD for protection.
A host can run intrusion countermeasures, or IC, to defend
itself. These programs are personas that seek out
and repel or punish hackers. IC is ruthless and efficient,
with the personality of a heart attack and the mercy of
an empty clip in a firefight. You can fight off IC, but the
host can always spawn more, so you can’t really win
against IC. You can just hold it off long enough to get
things done.
HOST ARCHIVES
Hosts have areas called archives that hold files that aren’t
in use. File archives are deep in the host’s code, inaccessible
to the average hacker. If you want an archived
file, you’ll have to convince someone who already has a
mark on the file to bring it out of the archive first.
HOST ATTRIBUTES
Hosts have a Host rating. Unlike the ratings of devices,
the Host rating ranges from 1 to 12. Hosts also have all
four Matrix attributes: Attack, Sleaze, Data Processing,
and Firewall. The ratings of these attributes are usually
(Host Rating), (Host Rating + 1), (Host Rating + 2), and
(Host Rating + 3), in any order. For example, a Rating 4
host might have Attack 5, Sleaze 4, Data Processing 7,
Firewall 6.
A host’s attributes are shared by itself and its IC programs.
HOST CONVERGENCE
GOD doesn’t track personas inside a host, but it still
keeps tabs on the traffic to and from the host. This
means your Overwatch Score doesn’t change when
you enter a host, and it continues to accumulate while
you’re in the host. If you’re in a host when you reach
convergence, you’re not burned and dumped like you
are out on the grid (Overwatch Score and Convergence,
p. 231). Instead, the host gets three marks on
you and starts deploying IC.
If you leave a host after convergence, the grid’s
demiGOD converges on you immediately. You’re better
off just jacking out from the host.
INTRUSION
COUNTERMEASURES
Intrusion countermeasures, or IC (pronounced “ice”), is
a type of program that runs in hosts. The purpose of
an IC program is to defend its host from attack, and it
tends to be cold-heartedly ruthless about it.
Each IC program has a persona with its own Condition
Monitor and Initiative Score. It should be treated as
if it is in hot-sim, so it gets a total of 4D6 Initiative Dice in
Matrix combat. IC uses the Matrix attributes of its host.
The IC in a host and the host itself share marks, so if one
IC program marks, they all do, and so does the host itself.
Similarly, the IC and host instantly share spotting
information, so if the host spots you, so does all its IC.
Which usually turns out not well for you.
Individual IC programs alone can be a threat, but
multiple IC programs working together can be deadly.
Once the host starts to launch IC, it’s time to finish up
and buzz out of there.
SECURITY RESPONSE
When a host spots you doing something unauthorized,
illegal, or just something it doesn’t like, it informs its
owner (or its owner’s designee, like an employed security
spider) and launches whatever IC programs it has to
fight off the intruder. A host can launch one IC program
per Combat Turn, at the beginning of each Combat
Turn. The host can have up to its rating in IC programs
running at once, and it can’t launch more than one of
each type of IC program at once. When an IC program
takes enough damage to brick it, it crashes and vanishes
from the host. The host can then run another copy of
the IC at the start of the next Combat Turn if it wants to.
Most hosts don’t have intrusion countermeasures
running all the time. While IC is mercilessly efficient,
it’s not very bright. The added safety of omnipresent
IC is outweighed by the cost of paying (or covering up)
wrongful injury and death lawsuits, especially since IC
can be deployed in seconds at the first sign of trouble.
Typically, the only IC that remains active 24/7 is Patrol
IC, which is mostly harmless to the innocent.