How it works

From synthetic identity to adversary intelligence.

Build the person. Plan controlled exposure. Observe who approaches. Define engagement boundaries. Organize what they reveal.

01Persona

02Exposure

03Contact

04Conversation

05Adversary

06Campaign

01 / Persona

Create someone believable.

A synthetic identity begins as a coherent person—not a disconnected inbox. Every detail supports the same role, history, organization, and digital life.

PERSONA / SS-1028 EXPOSURE READY

Sarah Chen

Finance Manager · Northstar Financial

NameSarah Chen

RoleFinance Manager

CompanyNorthstar Financial

DepartmentFinance

ManagerDavid Kim

LocationChicago, IL

BiographyCorporate finance

Identifiers

Assets

Communication channels

Digital relationships

02 / Exposure

Create controlled exposure.

Selected parts of Sarah’s synthetic identity can be made reachable or discoverable. Every surface is deliberate, governed, and built to protect real people—not target them.

SCSarah ChenControlled identity

Phone

Social profile

Directory presence

Controlled document

Controlled credential

Cloud identity

03 / Contact

Observe who approaches.

The contact model brings inbound activity back to the persona timeline so sequence and context can be preserved. Supported channels are confirmed during scoping.

EmailListening

VoiceListening

SMSListening

SocialListening

MessagingListening

AgentListening

SARAH CHEN / INBOUND ACTIVITY CONCEPT

09:14EMAILPassword expiration notice received

Unknown sender · new domain

11:32VOICECaller claims to be IT support

Callback number captured

14:08SMSFollow-up requests account verification

Pretext linked to prior call

14:11AGENTContact sequence correlated

Shared language · shared requested action

04 / Conversation

Observation becomes interaction.

stickysweet is designed for controlled exchanges within persona and safety boundaries. This conceptual workflow shows how an approach could reveal intent while analysts retain visibility and control.

Sarah ChenControlled conversation · Analyst visible

EXTERNAL · 14:13

Hi Sarah, this is Alex from Microsoft support. I need you to verify your account before access is suspended.

SARAH · CONCEPTUAL RESPONSE · 14:14

I can’t share credentials. What team are you with, and what case number should I give our internal IT desk?

EXTERNAL · 14:15

Global Account Services. Case MS-88419. Use the verification page I sent.

Proposed response within policyNo secrets disclosed · Link not opened · Evidence recorded

CONTROL LAYERConceptual guardrails

01Persona boundaries

02Permitted responses

03Prohibited disclosures

04Isolated credentials

05Constrained tool access

06Analyst visibility

07Audit trail

08Stop controls

05 / Adversary

Make them reveal more than an alert can.

A conversation can add context to an isolated signal: who the contact claims to be, what they want, how they operate, and which infrastructure supports the approach.

ADVERSARY PROFILEHelpdesk impersonator10 observed dimensions

01Claimed identity

02Email

03Phone

04Domains

05URLs

06Requested action

07Pretext

08Infrastructure

09Behavior

10Tactics

Campaign intelligence

These are not three independent alerts.

Three alerts can be one adversary. The stickysweet intelligence model brings interactions together around the people approached, shared infrastructure, actors, and campaigns.

Sarah Chen

Finance Manager

VoiceClaimed IT supportMFA request

Michael Torres

IT Administrator

SMSAccount verificationLink sent

Emily Parker

Executive Assistant

EmailSecurity alertCredential reset request

Actor 81AC · Active campaign

Microsoft Helpdesk Impersonation

High confidence

7Targeted personas

19Interactions

Voice · SMS · EmailChannels

Aug 11First observed

Shared indicators

Phone+1 (312) 555-0148

Domainlogin-secure-example.test

Emailsupport@example.test

Observed tactics

Helpdesk impersonationMFA solicitationUrgencyAccount compromise pretext

Fictional test data · Conceptual intelligence model, not automatic correlation

07 / Analyst experience

Move from event to understanding.

The intelligence model is designed to give security teams useful context and leaders a view across related activity, rather than another queue of disconnected alerts.

TRADITIONAL ALERT

“What happened?”

One event. One channel. One point in time.

STICKYSWEET INTELLIGENCE MODEL

“Who is doing this, what are they trying to achieve, and who else are they targeting?”

Identity, intent, infrastructure, behavior, and campaign context.

The operating architecture

One connected intelligence system.

Each layer preserves context for the next, turning controlled identity exposure into evidence that can be understood at campaign scale.

01PersonasBelievable identities

02ChannelsControlled surfaces

03InteractionsObserved behavior

04ActorsRelated signals

05CampaignsCoordinated operations

From attention to action

Turn attention into intelligence.

See the operating model in your environment.

Request access