I wanted to mock up some examples of how hacking can be effective in combat. It's entirely possible that I've got the rules wrong, so if you have a different interpretation of how things work, let me know. Similarly, if you think either party should use a different strategy, let me know. In our first scenario, we're going to be using a Brute-Force attack. I'm going to give the player enough bonuses that their rolls are exceptional (often through abuse of the teamwork bonus). I'll leave the guards at the normal status of Firewall 50 (from their Mesh Inserts, which are a Host). If they have a dedicated defender, they'll be better off. Brute-Force Attacks

• Infosec at 90 -30(brute-force) +30(teamwork) +10(Insight) vs. Firewall 50
• 15% of the time, we fail or don't succeed by as much
• 85% of the time we succeed (with security and admin access being common)
At this point, the guard is going to Terminate Connections in response to the Active Alert. This is a big enough deal that he'll probably send out a message to his team, then shutdown for multiple rounds. At this point, he's no longer vulnerable to hacking, but he is denied the benefits of TacNet, team communication, and his smartlink. If the guard just gets a Passive Alert (either because you get a critical, or because you failed), he'll probably only Terminate Connections for one round. If you do have access, you can now attack the Cyberbrain, though you'll need to spend a pool point to get that action in this turn. We'll take the Freeze Morph action, to permanently sever his connections to his morph (until he gets repaired). This takes him out of the fight.
• Freeze Morph: Infosec at 90 -30(cyberbrain) +30(teamwork) +10(Insight) vs. Firewall 50
• 85% of the time, we succeed by more, at which point that morph is unable to act
If we do fail, we can probably take another attempt (max of 3 actions, from spending 2 pool points). 85% of the time, we succeed by more, at which point that morph is unable to act.

Overall, we have a 83% chance to disable our opponent in an average of 2 actions. If you're given time, you can do a lot better. Instead of a Brute-Force Attack on the guard, we'll use Subtle Intrusion. Combinations of Psi, Digital Speed, Fokus, and Rushing the Job can get the time needed down to 15 minutes. That's short enough that you may be able to compromise the guard on his lunch break. Once again, we'll abuse teamwork too.

• Subtle Intrusion: Infosec at 90 -20(rushing the job) +20(teamwork) +10(Insight) vs. Firewall 50
• 15% of the time, we fail or don't succeed by as much - we don't get in, and a passive alert is triggered. It probably makes sense to give up for now, while it doesn't look too suspicious.
• 36% of the time, we succeed by more. In this case, we get in, but a passive alert is still triggered. A smart guard will Terminate Connections. If we use pool points for extra actions, it's possible to install a backdoor before that finishes (at the end of this turn).
• 49% of the time, we succeed and are undetected.
Now, we can install a backdoor for later
• Install Backdoor: Infosec at 90 +10(Insight) vs. Firewall 50
• 85% of the time, we will successfully install a backdoor.
Even if we fail, we can try again. It's very unlikely for us to get a critical or superior failure, which is what would be required to trigger an alert. Unless we're in the Terminate Connections phase, we can just assume this works.

Overall, we have a 83% chance to successfully install a back door Later, in combat, we'll be able to use that to disable the guard about 98% of the time. Between the two of these, we've got about a 83% chance to remove a guard. Well, that's pretty dangerous. Before the players all decide they're never sleeving in a synthmorph again, how does this look with the same god-tier attacker, but with a similar god-tier defender? First, the Brute-Force option

• Brute-Force Attack: Infosec at 90 -30(brute-force) +30(teamwork) +10(Insight) vs. Infosec at 90 +10(Insight)
• 50% of the time, we don't succeed by as much
• 50% of the time we succeed (with security and admin access being common)
At this point, the guard is going to Terminate Connections in response to the Active Alert. This is a big enough deal that he'll probably send out a message to his team, then shutdown for multiple rounds. At this point, he's no longer vulnerable to hacking, but he is denied the benefits of TacNet, team communication, and his smartlink. If the guard just gets a Passive Alert (either because you get a critical, or because you failed), he'll probably only Terminate Connections for one round. If you do have access, you can now attack the Cyberbrain, though you'll need to spend a pool point to get that action in this turn. We'll take the Freeze Morph action, to permanently sever his connections to his morph (until he gets repaired). This takes him out of the fight.
• Freeze Morph: Infosec at 90 -30 (cyberbrain) +30(teamwork) +10(Insight) vs. Infosec at 90 +10(Insight)
• 50% of the time, we succeed by more, at which point that morph is unable to act
If we do fail, we can probably take another attempt (max of 3 actions, from spending 2 pool points). 50% of the time, we succeed by more, at which point that morph is unable to act

Overall, we have a 38% chance to disable our opponent in an average of 2 actions. That's still pretty impressive, and provides a good motivation to use biomorphs. Here's the subtle version of that:

• Subtle Intrusion: Infosec at 90 -20(rushing the job) +20(teamwork) +10(Insight) vs. Infosec at 90 +10(Insight)
• 50% of the time, we don't succeed by as much - we don't get in, and a passive alert is triggered. It probably makes sense to give up for now, while it doesn't look too suspicious.
• 50% of the time, we succeed by more. In this case, we get in, but a passive alert is still triggered. A smart guard will Terminate Connections. If we use pool points for extra actions, it's possible to install a backdoor before that finishes (at the end of this turn).
Now, we can install a backdoor for later
• Install Backdoor: Infosec at 90 +10(Insight) vs. Infosec at 90 +10(Insight)
• 50% of the time, we will successfully install a backdoor.
If we do fail, we can probably take another attempt (max of 3 actions, from spending 2 pool points). 50% of the time, we will successfully install a backdoor.

Overall, we have a 38% chance to successfully install a back door These variants are still dangerous, but not terrible. In the case of the subtle variants, if a passive alert is triggered, the guard will probably Terminate Connection, and then go through the logs to see if there was actually an intrusion. If he finds an intruder, he can get back online and notify someone with better Infosec about the hacker's mesh ID. It's possible that you need another step, where after the Brute-Force Attack on the Mesh Inserts, you still need to make a Brute-Force Attack on the Cyberbrain, but I didn't interpret it that way. So what if our hacker wants to harass some biomorphs? He can't use Freeze Morph, but he can go after the TacNet and mark enemies as friends. The biomorph is likely to simply disengage the smartlink, in this case, but that's still useful. The hacker may also trigger a reboot or shutdown, to take the mesh inserts offline, but jamming communication is easier, and doesn't have as many delays. Edit: One advantage players have is they will likely be stealthed. This doesn't help against a subtle attack, but it does mean that if they just run into a guard hacker, that guard will need to spend a complex action (likely multiple) to find their signal (opposed test). Players will probably use their Muse's Interface of 60 for this test, and the guard has a penalty of -30. Also, while I used Infosec for defense for the players, that's probably not realistic. First of all, all players would need to slave their PAN to the defending hacker's PAN, which means a single successful intrusion exposes the whole party. Second, the defending hacker needs to spend every action doing the active defense, so isn't able to do anything else useful. There's a variation on this, where they're still all slaved, but the defending hacker's PAN is on a Server where the Firewall is 70 instead. In this case, the defending hacker can still do things other than full time defense. This setup is still very vulnerable to Subtle Intrusion, so I think it's still not worth it. Edit 2: I had an error with the numbers for the first two cases. After fixing that, the low Firewall is significantly more dangerous. Spoiler example based on playtest adventure Edit 3: Defensive options I think it's probably a good idea to attack the account shell being used to hack you. While the first action is unlikely to crash their shell, it will burden them with some pretty bad wound penalties (the average damage of 11 will cause 3 wounds). I think the typical hacker has a minimal defense against this (perhaps his Muse will defend). Lockout is a complex action, so it's a little awkward to crash and lockout (the hacker gets an action after you crash his account shell, and may just brute-force hack you again). Your muse can probably issue the lockout, though, while you crash the account shell. I'm not certain whether the hacker's Muse will be available on your mesh inserts (to defend the hacker's account shell). It seems likely that each additional intruder would need to do their own intrusion (unless a backdoor is created for them). Once one intruder has brute-force hacked you, the others will have a +30 modifier.