SC
Sarah Chen
Finance Manager
VoiceClaimed IT supportMFA request
The platform
Security starts with
someone believable.
A stickysweet persona is more than a mailbox or phone number. It is a controlled synthetic identity with an organization, role, relationships, assets, communication channels, and history.
01Persona
02Exposure
03Contact
04Conversation
05Adversary
06Campaign
01 / Persona
Persona identity.
Every detail contributes to a coherent person—specific enough to withstand scrutiny and governed enough to remain controlled.
SC
Sarah Chen
Finance Manager · Finance
LocationChicago, Illinois
BiographySeven years in corporate finance and treasury operations.
IdentifiersEmployee ID · email · mobile
Employment contextNorthstar Financial · Full-time
Organizational context
A person belongs somewhere.
Organizational consistency makes an identity believable. Reporting lines, colleagues, departments, domains, and job context reinforce one another wherever the persona appears.
CompanyNorthstar Financialnorthstarfinancial.com
ManagerDavid Kim
Finance ManagerSarah Chen
DepartmentFinance
TeamDirect reports
IdentityCorporate domain
Digital life
One person. Connected surfaces.
The identity model relates communication channels, devices, and accounts to one persona rather than treating them as unrelated decoys. The diagram is conceptual; it does not claim that each surface is operated today.
SC
Sarah ChenCanonical identityEmails.chen@northstar…
Phone+1 312 ••• ••48
Social identityIdentity reference
MessagingChannel concept
Microsoft 365Identity reference
LaptopNSF-LT-2841
Corporate directoryPublished
Cloud / SaaS identity4 assignments
Persona readiness
Know when an identity is ready.
Personas can be evaluated before activation or exposure, helping teams verify that enough identity detail exists across every required dimension.
92%Overall readiness
Exposure ready100
Profile95
Organizational90
Contact84
Device91
SocialReadiness rules can reflect the requirements of a particular persona, organization, or exposure plan.
Identity graph
Every detail has a relationship.
The identity graph keeps people, organizations, channels, devices, and services connected to their source persona.
SC
Sarah ChenPersonaNorthstar Financial
David Kim
Email
Phone
Laptop
LinkedIn
Microsoft 365
Slack
02 / Exposure
Put the identity where attackers look.
Controlled exposure is the deliberate practice of deciding what should be reachable, visible, or discoverable without putting a real employee at risk. Available surfaces and governance controls are confirmed during scoping.
01Reachable email
02Phone identity
03Social presence
04Directory listing
05Controlled credentials
06Document metadata
07Cloud identity
03 / Contact
Bring every inbound signal back to the person.
The contact model is designed to organize how outside parties approach an identity across human and automated channels. Supported channels are confirmed during scoping.
EmailInbound
VoiceInbound
SMSInbound
SocialInbound
MessagingInbound
AgentInbound
04 / Conversation
Observation becomes interaction.
The product model evolves beyond passive collection toward controlled interaction: preserving the contact sequence, observing what is requested, and surfacing behavioral signals without risking a real employee.
01
Inbound contactObserved today
02
ConversationControlled interaction · product direction
03
Requested actionIntent becomes explicit
04
Behavioral signalsPatterns become intelligence
Clear product boundary Interaction capabilities are introduced progressively and governed by deployment. The interface shown here communicates product direction, not a claim that every channel is currently deployed.
05 / Adversary
Turn an interaction into a profile.
Each exchange can reveal distinct facts. Connected together, those facts describe an adversary’s identity claims, infrastructure, intent, and behavior.
Adversary profileHelpdesk impersonationConfidence grows with each observed signal
01Claimed identity
02Email
03Phone
04Domains
05Links
06Infrastructure
07Requested action
08Pretext
09Tactics
10Behavior
Campaign intelligence
These are not three independent alerts.
Three alerts can be one adversary. The stickysweet intelligence model brings interactions together around the people approached, shared infrastructure, actors, and campaigns.
MT
Michael Torres
IT Administrator
SMSAccount verificationLink sent
EP
Emily Parker
Executive Assistant
EmailSecurity alertCredential reset request
Actor 81AC · Active campaign
High confidenceMicrosoft Helpdesk Impersonation
7Targeted personas
19Interactions
Voice · SMS · EmailChannels
Aug 11First observed
Shared indicators
Phone+1 (312) 555-0148
Domainlogin-secure-example.test
Emailsupport@example.test
Observed tactics
Fictional test data · Conceptual intelligence model, not automatic correlation
Foundation
Deception starts with identity infrastructure.
The platform’s core architecture governs identity as a durable system: what exists, how it is related, whether it is ready, where it has been assigned, and what has happened over time.
01Companies
02Personas
03Assets
04Identifiers
05Readiness
06Assignment history
07Activity records
08Identity graph
09Governed access
Persona-first deception