Hold the interaction.
“Sticky” means keeping suspicious actors engaged long enough to reveal additional behavior, tactics, and intent.
About stickysweet
Attackers no longer need to begin with an exposed server. They can begin with a person, a credential, an identity workflow, a web surface, or an AI agent—and chain those openings together at machine speed.
A new deception layer
Traditional honeypots remain valuable. They give defenders controlled technical infrastructure designed to attract, observe, and understand malicious activity.
stickysweet extends that same deception concept toward synthetic people and digital identities—the targets adversaries now discover, profile, and approach.
The internet already contains billions of identities.
What if some of those people were built to be found?
The name
The idea is simple: a convincing synthetic target should be attractive enough to approach—and useful enough to keep a suspicious actor engaged.
“Sticky” means keeping suspicious actors engaged long enough to reveal additional behavior, tactics, and intent.
“Sweet” is the attractive synthetic target: credible, discoverable, and relevant to the adversary looking for a way in.
The shift
Agentic systems change the scale and tempo of the entire attack lifecycle: research, target selection, social engineering, authentication probing, exploit development, tool chaining, and follow-on action.
Attackers can automate reconnaissance, personalize pretexts, probe identity and web surfaces, reuse infrastructure, and coordinate multi-stage activity across channels.
Defenders need controlled synthetic identities, distributed sensors, governed defensive agents, and proprietary telemetry that connects the human, identity, application, network, infrastructure, and campaign layers.
Synthetic people.
Real adversaries.
Full-stack telemetry.
A safer target