SC
Sarah Chen
Finance Manager
VoiceHelpdesk impersonationMFA approval requested
How it works
From synthetic identity to adversary intelligence.
Build the person. Deploy controlled exposure. Observe who approaches. Engage within policy. Correlate what they reveal across the full attack stack.
01Persona
02Exposure
03Contact
04Conversation
05Adversary
06Campaign
01 / Persona
Create someone believable.
A synthetic identity begins as a coherent person—not a disconnected inbox. Every detail supports the same role, history, organization, and digital life.
SC
Sarah Chen
Finance Manager · Northstar Financial
NameSarah Chen
RoleFinance Manager
CompanyNorthstar Financial
DepartmentFinance
ManagerDavid Kim
LocationChicago, IL
BiographyCorporate finance
Identifiers
Assets
Communication channels
Digital relationships
02 / Exposure
Create controlled exposure.
Selected parts of Sarah’s synthetic identity can be made reachable or discoverable. Every surface is deliberate, governed, and built to protect real people—not target them.
SCSarah ChenControlled identity
Email
Phone
Social profile
Directory presence
Controlled document
Controlled credential
Cloud identity
03 / Contact
Observe who approaches.
Every inbound signal returns to the persona timeline so sequence and context survive across human, identity, web, edge, and agentic channels.
EmailListening
VoiceListening
SSOListening
Web / EdgeListening
MessagingListening
AgentListening
SARAH CHEN / INBOUND ACTIVITY LIVE CORRELATION
EMAILPassword expiration notice received
Unknown sender · new domain
VOICECaller claims to be IT support
Callback number captured
SMSFollow-up requests account verification
Pretext linked to prior call
AGENTContact sequence correlated
Shared language · SSO attempt · shared infrastructure
04 / Conversation
Observation becomes interaction.
stickysweet conducts controlled exchanges within persona and safety boundaries so an approach can reveal intent while analysts retain visibility, evidence, and stop control.
SC
Sarah ChenControlled conversation · Analyst visible
Response executed within policyNo secrets disclosed · Link not opened · Evidence recorded
CONTROL LAYEREnforced guardrails
01Persona boundaries
02Permitted responses
03Prohibited disclosures
04Isolated credentials
05Constrained tool access
06Analyst visibility
07Audit trail
08Stop controls
05 / Adversary
Make them reveal more than an alert can.
A conversation adds context to identity, application, and edge signals: who the contact claims to be, what they want, how they operate, which infrastructure supports the approach, and where the sequence is likely to go next.
ADVERSARY PROFILEHelpdesk impersonator10 observed dimensions
01Claimed identity
02Email
03Phone
04Domains
05URLs
06Requested action
07Pretext
08Infrastructure
09Behavior
10Tactics
Campaign intelligence
These are not three independent alerts.
Three alerts can be one adversary. stickysweet correlates persona, identity, edge, infrastructure, and behavioral signals into one campaign view so the SOC sees the operation—not just the events.
MT
Michael Torres
IT Administrator
SSOCanary credential usedAuthentication attempt
EP
Emily Parker
Executive Assistant
EmailAccount security lureCredential reset requested
Actor 81AC · Active campaign
High confidenceAI-augmented helpdesk intrusion chain
7Targeted personas
24Correlated events
Voice · Email · SSO · WebSurfaces
18 minObserved sequence
Shared observables
Source IP198.51.100.24
Domainlogin-secure-example.test
Phone+1 (312) 555-0148
ASNAS64500 / example
Observed tactics
Synthetic example data · Cross-sensor campaign correlation
07 / Analyst experience
Move from event to understanding.
The intelligence model gives security teams a campaign view across related activity, while agentic analysis extracts observables, intent, and relationships faster than manual event-by-event triage.
TRADITIONAL ALERT
“What happened?”
One event. One channel. One point in time.
STICKYSWEET INTELLIGENCE MODEL
“Who is doing this, what are they trying to achieve, and who else are they targeting?”
Human, identity, web, edge, infrastructure, AI, behavior, and campaign context.
The operating architecture
One connected intelligence system.
Each layer preserves context for the next, turning controlled identity exposure and sensor activity into a proprietary SOC dataset that can be understood at campaign scale.
01PersonasBelievable identities
02ChannelsControlled surfaces
03InteractionsObserved behavior
04ActorsRelated signals
05CampaignsCoordinated operations
From attention to data advantage
Turn adversary attention into full-stack intelligence.
Generate proprietary telemetry your SOC can correlate, hunt, retain, and operationalize.