Guards behave in defined, often predictable ways. By default, most guards are either stationary or patrolling; guards react to agents and other suspicious things in their vision, noise, and other triggers from some security measures or mission-specific events. Guards can also change their status on some alarm level changes.

Information about a guard's current status is given by the status icon (if any) shown above them, and further information can be revealed by observing them.

A guard typically tries to take a shortest possible path to his destination. If possible, he moves diagonally first and orthogonally then.

A stationary guard stands on a particular tile, and stays there facing the same direction until their status changes. If a stationary guard investigates a distraction without becoming alerted, they will afterwards return to their assigned position, turn to face their assigned direction, and become stationary again.

Due to a bug in the game, the Captain in a Detention Center and the Financial Executive in a Chief Financial Suite do not remember which direction to face when they return to their stationary position, so they will remain facing the direction they took to walk back.

A patrolling guard.

A patrolling guard has two patrol points. Provided that he is not investigating something unusual, his goal in any given turn is to walk to the patrol point he has visited less recently.

Guards that start the mission patrolling will always start on one of their patrol points, but their initial facing direction may not be a direction he'd naturally be facing during this patrol.

On Beginner, a guard's patrol points will always be in the same room, and will always have a shortest-path of 5 tiles between them. On Experienced and up, the shortest-path between the two tiles will be equal to the guard's AP (which is usually 8), and they will often be in different rooms.

Patrolling guards usually have a 2-turn patrol cycle because they will always reach a patrol point every turn. Interest points can disrupt this temporarily. In addition, if two guard patrol routes interfere with each other, the guards may need to make extra moves to get out of each other's way, making 3 or 4-turn patrol cycles possible.

A guard's patrol points do not naturally change, though the security response when accessing executive terminals will change a guard's patrol points, as will Alarm Level 1 when playing with Advanced Alarm Stages. A guard completely forgets his patrol points once alerted.

I think I saw something.
—Civilian

When a guard is investigating or alerted, they have an interest point which is a tile they intend to move towards and investigate. A guard's interest point is revealed to the player when observing their movement, and in some situation's the interest point is revealed automatically; when the interest point is revealed, it is shown as a floating question mark (if the guard is investigating) or exclamation mark (if the guard is alerted).

Some interest points are “persistent” — if the guard is distracted with a new interest point, then if they finish investigating the new interest point without becoming alerted, then they remember the original “persistent” interest point and continue to investigate it afterwards.

A guard who is investigating.

Investigating… guess it was nothing.
—Guard

The status icon of a yellow triangle with a question mark indicates that a guard is investigating.

If a stationary or patrolling guard receives an interest point without becoming alerted, they will move towards the interest point, and investigate it when they reach it:

• Human guards investigate their interest points by peeking, first to the right, then to the left in the direction them end their movement; while peeking, they have a wider effective vision arc, and may notice an agent even behind soft cover. If a guard reaches his interest point orthogonally, he will peek from both his interest point and a tile in the front of him. If a guard reach his interest point in the front of a door, he will open this door before peeking.
• All drones except Pulse Drones investigate their interest points using their Local Scanner, which detects agents within a radius of 4 tiles, even behind soft cover. Pulse Drones only scan at the start of their movement.

The guards will prefer to reach their interest points orthogonally instead of diagonally. If the guard is investigating because they noticed a door open or close, then they will turn to face through the door, and open it if it is closed, before peeking or scanning. When a guard investigates their interest point, their next behaviour depends on what they find:

• If the guard finds nothing suspicious, then they return to their previous behaviour.
• If the guard notices something suspicious but without becoming alerted, then they turn to face the new interest point and continue investigating on the next enemy turn. The guard never becomes alerted if he notices something suspicious only from a tile in front of his interest point, even if it is an agent hiding behind a cover.
• If the guard sees a knocked-out agent or guard, a dead body, or a destroyed drone, then the guard turns to face the new interest point, becomes alerted, and hunts there immediately if the guard has enough AP to continue moving on the same enemy turn.
• If the guard sees an agent, a rescued Courier or Prisoner, or a drone or turret known to be a “traitor”, then the guard turns to face the new target, becomes alerted and immediately overwatches, tracking the target.

Guards sometimes peek or scan from a tile near their interest point, if their interest point itself is blocked by an impassable object or another guard. If a guard has no valid path to their interest point, they will peek or scan on their current tile instead, however far away the interest point is.

Located something suspicious!
—Guard

The status icon of a red triangle with an exclamation mark indicates that a guard is alerted. Once a guard is alerted, they remain alerted as long as they are active in the mission. Guards are more dangerous when they are alerted, because they actively hunt around the whole facility for agents, and their movement becomes much less predictable.

Guards become alerted in the following circumstances:

• Human guards become alerted when they wake up after being knocked out.
• Drones become alerted when they wake up after rebooting, except Pulse Drones.
• Guards become alerted when they see an agent, a rescued Courier or Prisoner, a knocked-out or dead guard, a destroyed drone, or a captured drone/turret after it has shot a camera/guard. If a guard becomes alerted in this way, the alarm tracker is also raised one step. If they see an agent, a rescued Courier or Prisoner, or a traitorous drone/turret, they will also shout, causing nearby guards to become alerted and investigate the agent/traitorous drone/turret's location.
• Guards become alerted when a Sound Bug sufficiently near to them is triggered by a noise.
• Guards become alerted if they see another guard knocked out or killed, even when the attacked guard is on a tile which would provide soft cover to an agent.
• Enforcers and Elite Enforcers are always alerted, as soon as they enter the facility.
• All guards in the facility become alerted at alarm level 5.

There is one confusing point here - when a guard has an ability referencing becoming Alerted (e.g. flack guards and sirens), this does NOT mean changing state to alerted state, in the above sense. Rather, it refers to the situation when a guard sees an agent, a rescued Courier or Prisoner, or a traitorous drone/turret, causing them to shout and go onto overwatch. This means that such abilities still trigger if the guard was already alerted before the shout, and do not trigger when these guards become alerted in other ways, such as alarm level 5.

A guard who is preparing to hunt.

Guards prepare to hunt after waking up from being knocked out. The guard's interest point will be the tile they were attacked from; for melee attacks this will be the same tile they were knocked out on, but for ranged attacks this will be the agent's tile when they made the attack.

At alarm level 5, all guards in the facility who were not previously alerted will prepare to hunt. Each guard's interest point will be their own current location, unless they are the nearest guard to the agent who is located, in which case their interest point is that agent's location.

When a guard is preparing to hunt, they behave the same way as an investigating guard, except that they remain alerted regardless of what they find when investigating. After preparing to hunt, the guard begins hunting the next turn.

A guard who is hunting.

You can run, scum, but you can't hide!
—Guard

When a guard is hunting, he is actively looking for agents. A hunting guard always has a specific tile of the facility that he is heading towards in order to investigate. When he reaches this point and doesn't find anything, he will go somewhere else in the facility. When this happens, the hunting guard's new interest point is not revealed to the player except by observing him or causing him to be TAGged - if the guard is already TAGged, his interest point will not be passively revealed.

Hunting guards are trying to sweep the whole facility, and when they're deciding where to go after investigating, they will search the closest area they haven't previously explored. (“Area” roughly corresponds to “room”, but some large rooms may have multiple areas).

Hunting guards can be distracted by anything that would distract or alert other guards, and will reset their sweep of the facility when this happens.

Aaaaaaah!
—A civilian

In any situation where an armed guard or drone would become alerted, civilians will instead panic. A panicking civilian will run towards the nearest guard entrance that they have a valid path to. Once the civilian reaches the guard entrance, they teleport out of the facility.

While a civilian is panicking, they will still track agents or other targets in their vision, but their behaviour never changes from panicking.

Due to a bug in the game, if a panicking civilian has no valid path to any guard entrance, the game gets stuck during the enemy turn, and the player must press the Esc key to continue the game. Other guards will not move or perform any other actions, even if they have not already moved or acted yet during that enemy turn.

A guard who is on overwatch.

STOP THERE!
—A guard

When an armed guard sees a non-KOed, non-lethally wounded agent, a rescued Courier or Prisoner, or a traitorous drone/turret with their primary vision, they immediately turn to most directly face the spotted enemy, shout and alert all nearby guards, and overwatch the seen enemy or enemies. If any guards hear this shout and are able to see the spotted enemy by turning, they will immediately do so and overwatch the target as well.

If an overwatched enemy performs actions that do not result in the guard no longer being able to see them, the guard will shoot that enemy, dealing lethal damage. In addition, if the enemy is still in the guard's vision at the beginning of the corporation's turn, they will be shot as well. (A few actions will not cause an overwatching guard to shoot, such as using a Buster Chip, and inventory management actions, such as equipping, dropping, picking up, or trading items.)

Agents and other agency-controlled units can escape overwatch themselves with any action that immediately results in them not being seen by any overwatching guard, such as:

• Moving behind cover
• Closing a door in a way that breaks all lines of sight towards them
• Using a Cloaking Rig
• Attacking the overwatching guard with a weapon.
  • On Expert Plus, melee weapons cannot be used against guards by enemies they see.

In addition, other agents can assist the overwatched agent by closing doors or attacking the overwatching guards, and Incognita can sometimes help with Shade or Lightning, or by hacking overwatching drones. If an enemy escapes overwatch, the guard will gain an interest point on that enemy's current tile after escaping.

As long as a guard is overwatching and sees at least one enemy, they will not respond to any other distractions and will not remember them. They will immediately shoot any enemy that enters their primary vision cone, even if they did not originally overwatch that enemy.

If all enemies leave an overwatching guard's vision, the guard can be distracted as normal. However, if an enemy enters the overwatching guard's vision again this turn, they will still immediately be shot.

Unarmed drones follow all the same rules that armed guards do, except that they cannot shoot. In addition, Camera Drones and Refit Drones do not shout and alert other guards when they see an enemy - the effect of being seen by them is similar to that of being seen by a security camera.

Lost 'em!
—Guard

Enemies that a guard has seen are tracked by that guard (in addition to overwatched if the guard is armed). This means that the guard will turn to most directly face tracked enemy if they move while in the guard's vision, including peripheral vision. Armed guards can immediately shoot the tracked enemy if the guard sees them after turning. This means that it is not possible to escape a guard overwatching at point blank range by trying to move around them.

Guards will not turn to see tracked enemies that merely end a move in peripheral vision - they will only turn if the tracked enemy started the move in their peripheral vision, allowing the tracked enemy 1 tile of safe movement through that guard's peripheral vision. If a guard has turned to track an agent, he will shoot any agent that is in his direct vision after turning, even if it's not the agent he was originally tracking.

If a tracked enemy opens a door that is noticed by the overwatching guard, the guard will turn to track that enemy's next move.

A guard will not turn to track enemies moving through his peripheral vision if the enemy was not directly seen by the guard, and therefore isn't tracked. It is, however, possible for a guard to attempt to track multiple enemies at the same time.