Physical security is the bread and butter of a typical Shadowrun. This is the locks you pick, the walls you scale, the guards you shoot. There is some overlap between all the other arenas of security because at the end of the day the characters are physical in the majority of the cases.
Taking an abstract look at physical security can lead to some useful thoughts. I"m relatively sure you could flow chart it, but I’m not going to do that tonight.
As a loose analogy your asset is the treasure in your castle. Your security is everything that keeps brigands from running off with it. There are two ways to imagine/build security. Outside in, or inside out. I would say that if you prefer a more loose style, work outside in, and if you prefer a more rigid style work inside out.
For this article I’m going to work outside in.
Your first defense in a castle is location. If it is remote, unheard of, and difficult to reach then you Deter most threats right off. This means that most assets are going to be either hidden in metroplexes, or on “Black Sites” where they are remote from all civilization. Sticking your R&D building inside your Corp controlled zone, inside a hidden basement of a massive office building is a good start. Burying it in an ancient military bunker off in “Fuck you it used to be utah” is also a good option. Nobody knows to look there, nobody looking should find it, and those that do will seriously reconsider bothering.
The more difficult the run, the more remote/hidden/inaccessible the Asset.
After location you have your outer curtain of Countermeasures. This is your wall and moat, and archers on the wall. Controlling the area around your castle and preventing anyone from just wandering in. A killing field is a good Countermeasure. Clear the area around your Asset, then set people/drones to watch. Anyone approaching that doesn’t look friendly you shoot to kill. In a good killing field there is no cover. In Shadowrun this would be an open area surrounding your perimeter drones or guards. In a city this is tricky. Call it a parking lot, or a park, or a massive concrete poured foundation that never got used. The approach is wide open and scary.
Your walls for your castle are still walls. Fences, walls, anything that stops or impedes ground based movement. Open pits. What ever. Players will either avoid them and go for the “gate” or they will figure out a way over/through. Walls channel characters into areas that Security can focus on. This is a gate house, or a draw bridge type situation. the walls can be bypassed but it is difficult.
All castles must at some point be entered, and all assets must at some point be accessed. This point of access could be called a Gate or Door. It is an approved, monitored, safe way through your outer curtain. This is your guard shack at the entrance to the parking garage. It is your lobby to the office building. It is the security screening room. It is any choke point/stopping point where the players MUST interact with security. Avoiding a gate is difficult to impossible depending on how Security is set up. If someone hits exceptional on Leg Work, let them bypass the Gate, but show them the Gate. Let them see the teeth of the portcullis, have them feel vicariously the iron gaze of guards.
Gates are typically manned in some respect. Walls sometimes have watchers, but almost every gate is guarded. A single person or drone is a low security countermeasure. As you add defense in depth (multiple checks or measures) you increase player chances to fail. A player will always, eventually fail a roll. The more you force dice rolls, the more you force a failure. Be aware that any challenge you put up can get a failure, and prepare for that event. For a Gate there is normally a challenge to see if you belong. ID check, biometrics, something. Even a bouncer at a club is a Gatekeeper. The more systems you add to detect an intruder the harder the Gate becomes to penetrate. Sometimes prepwork can disable a check. Allow that. Encourage players to outsmart “you”.
Once you pass the Gate you are in the inner courtyard. This is a place of lowered security. the outer walls keep trouble away, and once penetrated typically things are easier for a time. This is the halls of the offices, this is the dance floor. This is backstage at the concert, but not the dressing rooms. Build tension here. Side glances from suspicious types. The blink of a drone camera light. The chatter of matrix security sweeps going on as normal. Consider a brush with danger, the players need to use the elevator, as they get in a security guard jogs up telling them to hold the door. You can escalate the situation and force another check/roll, or you can crank the adrenaline and have him just ride the elevator in awkward tense silence. Composure rolls? Does he notice your gun? Can he see how nervous you are?
Past the courtyard you are facing the inner sanctum. You are steps away from your prize. The asset is behind some few small steps and security is now in Risk/Threat management mode line none other. This is what it all comes down to. Defense is almost always stacked in serious depth here. Multiple types of multiple arenas of defense. Locked doors, monitored video feeds, live irritable guards. Even a bait/trap/honeypot looks like this to lure a team to their doom. Here you will face elevated ratings of devices and guards. If you had to deal with a typical R3 maglock to get past the Gate, you are now looking at R4 or R5. Guards that were lax before are now alert, and if they were alert before they are now bordering on zealous.
Once this level is reached there is typically about to be a shit storm. Dice rolls will be frequent, and a failure is likely. This may mean someone takes a bullet, this may mean an alarm is triggered. This could be a small failure, or critical. Either way, don’t punish the players, threaten the characters. This is the height of the night, the peak of the movie or book. The security boss monster is here and the players want to slay it.
Shadowrun encourages both incredibly brilliant solutions and incredibly violent ones. Players will often manage to combine the two. A pink mohawk game at this point is likely to take a turn to a running gun battle, mirror shades are likely to start considering some nasty final solutions, or already have a deadly plan. Know the security stats. Average guys have 4 dice, professionals 6, veterans 8 ( dice on each Guard. That maglock that you don’t have a key to? Not matrix enabled, hard wired to the door and off the main feed. It can’t be hacked, it has to be manually overridden. And it’s R5, with tamper resistance. That drone? Running a fuzzy logic clearsight pilot software suite, maybe two thousand in the world like it. It’s smarter than half your team.
Most times, you’re not going to get away with beating the boss security unscathed, or not without alerting the rest of the security. This is kicking a wasps nest. You now have a time limit for how long until the real shit hits the fan. Most Shadowruns are against places that can field a High Threat Response team, corporate SWAT/Spec Ops. Legwork can till you their response time, but it is always short and terrifying. A long wait time would be ten minutes, short wait time is measured in how many floors they are from you, and it’s never many. Combat turns in some cases.
Stress avoiding this situation, and stress escape. Let players know that they will get gunned down if they stay. If they stay, gun them down, have them eat the edge loss and run an escape game next session. Or have them picked out of the gutter by an old friend, or an old enemy. Let them know that this is the big leagues and they will get destroyed if they let the hammer fall.
Now not every run has HTR. If security scales 0-7 then most runs are in the 3-4 range. Average device ratings, professional guards with a few veterans. This is ten minutes till HTR if they get called. Assets are worth a lot in Shadowrun, or there would be no game. So HTR might not get called every single time, but it will be on the important list of things to do in case of emergency. I’d say if you trigger 8-Rating alarms you get HTR, or if you kill someone or blow something up. So on an average run you’ve got Rating 3-4 Security, you might get to fail 4-5 times. Average group that’s once each. After that, the next screw up sinks you. You need to abort mission and get out, or think about finishing quickly and maybe getting dead.
You might adopt a stoplight system for security in addition to a rating. Green is all good, no alerts, no worries, operations normal. All Security ratings are standard. At Yellow conditions there are some concerns, someone is suspicious, something is going odd from the view of Security. I would add two dice to Security opposed rolls. They are on alert, but maybe not actively looking. This is good for raising stakes and tension, and hinting at a major conflict/HTR in the future. Red alert is open conflict, active hunt against intruders, HTR on route. Add a rating or two to your base security and you have an idea of HTR response type. At R3-4 Security you’re looking at veterans or elite guards/soldiers whatever. This is bad news. There will be a dozen guys here rolling ten dice each to try to kill you. Above R4 you are reaching into insanity facing HTR. R5 normal security is like lower level HTR. These guys are sharp and aggressive. The backup team they call in? You don’t want to know. Each one is a specialist and out for your blood. 12-14 dice. You’ve decided to run into a top end R6-7 security zone and steal a file but you crit failed? You’re now less than a minute away from having six of the worlds best coming down on you with millions of nuyen worth of gear each. Your time in this world is over. They are rolling more dice than you, more dice than two of you. They will not pause to destroy you, and they are literally moments away.