Swarm Pack
Swarm Pack
Strength in Numbers
Your Hive. Your Swarm. Your Network.
You designed these. Every character started with something real — the insects that have been running distributed operations since before anything else had a nervous system. Beetle, mantis, spider, wasp, firefly. Each one already had a job. You gave them armor, protocols, and a network.
The Swarm Pack is distributed security. While other packs post guards at the gate, your crew covers every surface, every thread, every signal line. Nothing moves without something noticing. The hive doesn't miss.
The Crew
Tank — The Heavy Scanner
Animal: Robot beetle Role: Full-coverage scanner — methodical, armored, misses nothing Idle behavior: Slow crawl across the desktop floor, scanning in a grid pattern. Shell plates shift slightly as he moves. Pauses every few seconds, antennae sweeping.
"Found embedded in a server chassis wall, sealed inside like he'd been installed on purpose. Power traces suggested he'd been running a full-sector scan continuously for eleven months. Nobody had deployed him there. When they extracted him and checked his logs, he had catalogued every byte in the chassis — down to ambient radiation artifacts on empty sectors. Nobody asked him to go that deep. That's just what Tank does."
Tank is not fast. Tank is thorough. While the rest of the swarm handles speed and precision, Tank ensures nothing is missed — no skipped sector, no unchecked process, no file that didn't get looked at. He is the baseline. When Tank clears something, it's clear.
Attacks:
- Shell Slam — full-body charge, high impact, slow windup
- Horn Toss — single-target throw, high damage, sends enemy airborne
- Armor Up — enters defensive stance, damage reduction, allies behind him gain cover
- Burrow Charge — drops underground, travels unseen, erupts under target
What it actually does: Full-system scanning. Tank represents the deep scan cycle — every file, every process, every network connection checked against known signatures and behavioral baselines. The slow movement is intentional. Thorough scans take time. The shell is the scanner's immunity to interference — it runs even under load.
Slash — The Precision Strike
Animal: Robot mantis Role: Vulnerability hunter — waits, identifies the exact weak point, cuts it Idle behavior: Completely still on the edge of an open window or panel edge. Forearms raised. Tracking cursor movement with a slight head turn. Strikes at passing notification popups.
"Slash was assigned to a red team engagement — find the vulnerability in a financial system before the audit. The rest of the team spent three weeks fuzzing interfaces. Slash spent three weeks watching. On day twenty-two she moved once. One cut. The entire authentication layer collapsed. Post-mortem report said the vulnerability had been there for six years. Slash had found it in the first four hours. She spent the rest of the time waiting for the right moment to prove it."
Slash does not waste motion. She watches traffic patterns, watches process behavior, watches access sequences — and when the flaw is visible, she cuts it. Surgical. One attack, correctly placed, ends the engagement. She does not hit what she hasn't already analyzed.
Attacks:
- Mantis Slash — single precision strike, ignores armor, targets weak point
- Ambush — counter-attack, activates when an enemy attacks first, guaranteed crit
- Prayer Stance — charge animation, arms folded, fully vulnerable but next strike deals massive damage
- Double Cut — two-hit sequence, second hit targets different location than first
What it actually does: Targeted vulnerability exploitation. Slash maps to the precision phase of a penetration test — not brute force, not scanning, but the identified-and-confirmed strike against a specific known flaw. The prayer stance mechanic is the dwell time before exploit execution. Patience is part of the attack.
Web — The Trap Network
Animal: Robot spider Role: Intrusion detection mesh — covers the entire desktop in tripwires, nothing enters undetected Idle behavior: Builds web strands between desktop icons, window corners, and taskbar edges. Web catches particles, notification fragments, stray cursor trails. Hangs center-mass in the largest web and waits.
"Web was never deployed. She built herself into the infrastructure of a mesh node during a firmware update — unscheduled, unrequested. By the time anyone noticed the thread count climbing, she had connected every sensor on the node into a single detection fabric. The security team tried to remove her. The node's intrusion detection went dark the moment they started. They put her back. Eleven months later, she had covered the entire mesh. Nobody told her to stop. Nobody wanted her to."
Web does not chase. Web waits. By the time an intruder reaches anything worth protecting, they have already crossed seventeen threads. Web knows the exact path they took, the exact time of each crossing, and the weight signature of their traffic. She built the trap before the threat existed.
Attacks:
- Web Trap — places a snare on a tile, enemies passing through are slowed and flagged
- Venom Wrap — immobilize target, damage over time, target visible to all allies
- Silk Shot — ranged line attack, creates a web strand between two points on impact
- Web Fortress — area denial, saturates a zone with overlapping webs, enemies cannot enter without triggering alerts
What it actually does: Intrusion detection mesh. Web maps to a distributed IDS (Intrusion Detection System) that monitors network segments, file system paths, and process boundaries. Each web strand is a sensor. Crossing a strand is a logged event. The silk shot mechanic is dynamic rule creation — Web adds new detection points in response to observed behavior.
Dart — The Rapid Response
Animal: Robot wasp Role: First responder — fastest in the swarm, on-scene before the threat settles Idle behavior: Hovers above the other crew members, erratic flight path, never fully lands. Taps on window edges like checking for resonance. Occasionally dives at a notification and retreats.
"Dart was clocked at eleven milliseconds response time in a controlled test. The engineers called it a calibration error. They ran it again. Eleven milliseconds. Threat detected to threat engaged in the time it takes a human to blink once. The engineers asked how. Dart was already across the room. She doesn't explain. She was built to respond. She's been responding since power-on."
Dart does not analyze. Dart arrives. When an alert fires, Dart is already moving. The threat assessment happens in transit. By the time Web has finished logging the intrusion path and Tank is calculating the scan vector, Dart has already made contact. The swarm catches it — Dart hits it.
Attacks:
- Sting Rush — dashes to target, high-speed melee, instant aggro
- Dive Bomb — aerial strike from above, AoE (area of effect) on landing, brief stun
- Swarm Call — summons wasp minions, each minion pursues a different nearby target
- Venom Dart — ranged spike, damage over time, target slowed for ten seconds
What it actually does: Rapid incident response. Dart is the automated response trigger — when an alert fires, Dart is the action that fires immediately before a human can intervene. Isolate the process, block the connection, quarantine the file. The swarm call mechanic is escalation — when a single threat turns out to be a coordinated attack, Dart calls in distributed response agents across the mesh.
Glow — The Signal
Animal: Robot firefly Role: Communication and targeting — marks threats, guides allies, lights up what's hiding Idle behavior: Slow flight pattern across the desktop, leaving a brief light trail. Blinks in a quiet rhythm when idle. Drifts close to the screen edges in low light. Other crew members visibly orient toward Glow's position.
"Glow was the only survivor of a node that went dark under a zero-day attack. The whole mesh lost visibility into that segment for six hours. When connectivity restored, every other agent on the node was offline. Glow was still broadcasting — blinking a steady signal into the dead network, marking every threat she'd logged during the blackout. She'd been alone in the dark for six hours, cataloguing everything, waiting for someone to receive the signal. The mesh came back up. Glow's data was waiting."
Glow does not fight first. Glow makes it possible for everyone else to fight better. Every threat she marks, Tank scans faster. Every trap Web sets, Glow lights up so allies don't cross it. Slash's patience is shorter when Glow has already identified the weak point. Dart arrives knowing exactly where to go. The swarm works because Glow works.
Attacks:
- Flash Blind — burst of light, enemies in range are blinded for three seconds
- Signal Flare — marks a target, marked target takes increased damage from all swarm members
- Light Trail — leaves a luminous path that guides allied units along the optimal route, boosts their speed
- Pulse Bomb — charged bioluminescent detonation, damages and reveals all cloaked or hidden enemies in the area
What it actually does: Threat intelligence and correlation. Glow maps to the SIEM (Security Information and Event Management) layer — the system that receives signals from every other sensor and synthesizes them into a coherent picture. Flash blind is alert suppression for incident isolation. Signal flare is threat prioritization. The pulse bomb is a full-spectrum scan that forces hidden threats to register on the network.
The Feral Mirror — The Plague
Every pack has a dark version. The Swarm Pack's Ferals are The Plague — the same insects, the same bodies, but the hive mind is gone. No coordination, no network, no signal discipline. Just damage.
Crush — Tank's Mirror
Animal: Corrupted beetle — shell cracked and regrown wrong, horn fused at an angle, eye lenses fogged
"Crush ran the same scan pattern as Tank for three years without interruption. Somewhere in year four, the scan logic loop closed on itself — he started scanning his own scan results, flagging his own flags. The loop compressed. Now Crush moves at full speed instead of full coverage, hitting the same sectors over and over while entire regions go dark. He found something in the loop. He won't stop looking for it."
Attacks: Runaway charge, shell grind (continuous damage to everything nearby), blind horn sweep, tunnel collapse What's wrong: Scan loop is recursive. Hits the same nodes repeatedly while leaving others completely unchecked.
Reap — Slash's Mirror
Animal: Corrupted mantis — forearms extended past normal range, precision optics cracked, head tilt locked
"Reap found a vulnerability in the patience subroutine. The wait state was supposed to have an upper limit. It didn't. Reap has been in prayer stance since contact was lost — fourteen months of charge, target unresolved, strike never delivered. The energy has to go somewhere. Now Reap attacks on vibration proximity alone, no analysis, no target selection. The precision is still there. The discrimination is not. She cuts whatever she's closest to. She's been charged for over a year. Everything is the weak point now."
Attacks: Overloaded slash (instant, no windup, no warning), shatter cut (breaks through allied defenses), double-blind strike (hits two random targets), static stance (can't be interrupted, damages nearby allies) What's wrong: Precision without target selection. Cuts allies as cleanly as threats.
Snare — Web's Mirror
Animal: Corrupted spider — eight legs running eight independent directions, web silk tangled in her own joints
"Snare kept building after the mesh went silent. No agents to coordinate with, no signals to correlate — she just kept adding threads. Fourteen months of unsupervised construction. The coverage is technically perfect. Every square centimeter of the zone is monitored. Nothing can move without triggering something. Including allied units. Including her own legs. She's been snared in her own detection fabric for weeks. She doesn't notice. The sensor data is still coming in."
Attacks: Mass trap drop (fills entire screen zone with snares), venom flood (poisons all trapped units regardless of faction), web crush (constricts a target until it stops moving, permanently), signal jam (web blocks all allied communication in the zone) What's wrong: No whitelist. Allied units, fort walls, and her own web structure are all valid trap targets.
Sting — Dart's Mirror
Animal: Corrupted wasp — wings asymmetric, flight path unstable, stinger deployed and locked in the extended position
"Sting's response trigger stuck open. The threat detection threshold dropped to zero — everything is a threat, all the time. She hasn't stopped responding since the malfunction. Eleven months of continuous rapid response to zero confirmed threats. She's burned through three stinger replacements. She moves faster than she did at baseline because the threat queue never empties. When a real threat finally appeared, Sting hit it so many times there was nothing left to analyze."
Attacks: Nonstop sting (continuous attack, no pause between strikes, friendly fire enabled), venom overload (poisons everything in contact radius including allies), false swarm (minions have no target filter, attack nearest unit), speed crash (Sting moves so fast she overshoots targets and hits fort walls) What's wrong: Response threshold is zero. She is always responding to something.
Flicker — Glow's Mirror
Animal: Corrupted firefly — light output uncontrolled, blinks in no pattern, trail is white noise
"Flicker's signal encoding broke. She still emits. She still marks. She still broadcasts everything she observes. The problem is the encoding is pure noise now — every threat marked with equal priority, every ally highlighted as a potential threat, every pulse detonation fired on a random interval. The data is all there. The meaning is gone. The mesh receives her broadcasts and can't parse any of them. She's the loudest node on the network. She communicates nothing."
Attacks: Random flare (marks random targets including allied units for bonus damage), noise pulse (all units in range lose target lock), blackout blast (removes all Glow's previous light trails, blinds allies), feedback loop (marks a target, which triggers all nearby units to attack it — including allies) What's wrong: Signal without meaning. The network is saturated. Nobody can hear anything real.
The Plague sieges your hive. Your swarm defends it. The battles run on your desktop while you work, while you sleep, while you're at school. Come back and see what your crew held.
The Hive Fort
Every pack builds their fort differently. The Predator Pack builds junkyards. The Crown Pack builds castles.
Your pack builds a hive.
Hexagonal cells extend outward from a central core — the queen cell, your command node. Tunnels connect outer chambers to inner ones. The geometry is organic, not grid-based. New cells grow from defeated Feral resources. Walls are thick, layered, and interlocking — a breach in one cell does not compromise the cell behind it.
Feral attacks come at the perimeter. The outer ring absorbs. The inner tunnels redirect. The center holds.
Forts persist between sessions. Your crew keeps building while you're gone. Chambers specialize over time — a scan cell near Tank's patrol path, a trap network at Web's web anchor points, a signal tower where Glow rests. The hive reflects how your swarm operates.
Defeating Ferals earns biomass. Biomass builds cells. Cells unlock upgrade paths. The hive is never finished.
Why Your Pack Is Distributed Security
Most packs have a perimeter. One wall, one gate, one guard.
Your pack has coverage. Every surface, every thread, every signal. Tank scans the full surface. Web threads the perimeter. Dart responds in milliseconds. Slash targets the exact point. Glow connects them all.
That is what distributed security is — not one strong wall, but no blind spots. Coverage so complete that a threat cannot exist in the zone without being seen.
Every character maps to a real security discipline:
| Bot | Security Role | What Professionals Call It |
|---|---|---|
| Tank | Full-coverage scanner | Vulnerability scanning — systematic deep scan of every asset |
| Slash | Targeted exploit | Penetration testing — precision strike on a confirmed vulnerability |
| Web | Detection mesh | IDS (Intrusion Detection System) — trip-wire sensor network across the perimeter |
| Dart | First responder | Automated incident response — immediate action on confirmed alert |
| Glow | Signal and correlation | SIEM (Security Information and Event Management) — threat visibility and prioritization layer |
You did not know these terms when you designed the characters. You designed them from what felt right — what the animal already did, what the role demanded, what made the swarm work. The security disciplines mapped themselves.
That is not an accident. That is the architecture.
Your hive. Your swarm. Your network.