SC
Sarah Chen
Finance Manager
VoiceHelpdesk impersonationMFA approval requested
The platform
Security starts with
someone believable.
A stickysweet persona is more than a mailbox or phone number. It is a controlled synthetic identity with an organization, role, relationships, assets, credentials, communication channels, and history—connected to a distributed sensor layer and campaign intelligence.
01Persona
02Exposure
03Contact
04Conversation
05Adversary
06Campaign
01 / Persona
Persona identity.
Every detail contributes to a coherent person—specific enough to withstand scrutiny and governed enough to remain controlled.
SC
Sarah Chen
Finance Manager · Finance
LocationChicago, Illinois
BiographySeven years in corporate finance and treasury operations.
IdentifiersEmployee ID · email · mobile
Employment contextNorthstar Financial · Full-time
Organizational context
A person belongs somewhere.
Organizational consistency makes an identity believable. Reporting lines, colleagues, departments, domains, and job context reinforce one another wherever the persona appears.
CompanyNorthstar Financialnorthstarfinancial.com
ManagerDavid Kim
Finance ManagerSarah Chen
DepartmentFinance
TeamDirect reports
IdentityCorporate domain
Digital life
One person. Connected surfaces.
The identity model relates communication channels, devices, accounts, credentials, and services to one persona rather than treating them as unrelated decoys.
SC
Sarah ChenCanonical identityEmails.chen@northstar…
Phone+1 312 ••• ••48
Social identityIdentity reference
MessagingActive channel
Microsoft 365Identity reference
LaptopNSF-LT-2841
Corporate directoryPublished
Cloud / SaaS identity4 assignments
Persona readiness
Know when an identity is ready.
Personas can be evaluated before activation or exposure, helping teams verify that enough identity detail exists across every required dimension.
92%Overall readiness
Exposure ready100
Profile95
Organizational90
Contact84
Device91
SocialReadiness rules can reflect the requirements of a particular persona, organization, or exposure plan.
Identity graph
Every detail has a relationship.
The identity graph keeps people, organizations, channels, devices, credentials, services, and observed attack activity connected to their source persona—creating the context required for full-stack correlation.
SC
Sarah ChenPersonaNorthstar Financial
David Kim
Email
Phone
Laptop
LinkedIn
Microsoft 365
Slack
02 / Exposure
Put the identity where attackers look.
Controlled exposure is the deliberate practice of deciding what should be reachable, visible, or discoverable without putting a real employee at risk. Exposure can span identity, communication, web, edge, credential, document, and cloud surfaces.
01Reachable email
02Phone identity
03Social presence
04Directory listing
05Controlled credentials
06Web / edge surface
07Cloud / SaaS identity
03 / Contact
Bring every inbound signal back to the person.
The contact model organizes how outside parties approach an identity across human and automated channels and preserves every signal on the same persona timeline.
EmailInbound
VoiceInbound
SSOInbound
Web / EdgeInbound
MessagingInbound
AgentInbound
04 / Conversation
Observation becomes interaction.
stickysweet moves beyond passive collection into controlled interaction: preserving the contact sequence, observing what is requested, extracting intent, and surfacing behavioral signals without risking a real employee.
01
Inbound contactObserved and retained
02
ConversationGoverned agentic interaction
03
Requested actionIntent becomes explicit
04
Behavioral signalsPatterns become intelligence
Governed interaction Persona policy, isolated credentials, constrained tools, audit history, analyst visibility, and stop controls bound every engagement.
05 / Adversary
Turn an interaction into a profile.
Each exchange can reveal distinct facts. Connected with identity, web, edge, and infrastructure telemetry, those facts describe the adversary’s intent, tradecraft, access path, and campaign behavior.
Adversary profileHelpdesk impersonationConfidence grows with each observed signal
01Claimed identity
02Email
03Phone
04Domains
05Links
06Infrastructure
07Requested action
08Pretext
09Tactics
10Behavior
Campaign intelligence
These are not three independent alerts.
Three alerts can be one adversary. stickysweet correlates persona, identity, edge, infrastructure, and behavioral signals into one campaign view so the SOC sees the operation—not just the events.
MT
Michael Torres
IT Administrator
SSOCanary credential usedAuthentication attempt
EP
Emily Parker
Executive Assistant
EmailAccount security lureCredential reset requested
Actor 81AC · Active campaign
High confidenceAI-augmented helpdesk intrusion chain
7Targeted personas
24Correlated events
Voice · Email · SSO · WebSurfaces
18 minObserved sequence
Shared observables
Source IP198.51.100.24
Domainlogin-secure-example.test
Phone+1 (312) 555-0148
ASNAS64500 / example
Observed tactics
Synthetic example data · Cross-sensor campaign correlation
Foundation
Deception starts with identity infrastructure.
The platform’s core architecture governs identity as a durable system: what exists, how it is related, whether it is ready, where it has been assigned, and what has happened over time.
01Companies
02Personas
03Assets
04Identifiers
05Readiness
06Assignment history
07Activity records
08Identity graph
09Governed access
Persona-first deception · full-stack intelligence
Build the person.
Own the attack telemetry.
Turn synthetic identities, credentials, applications, edge sensors, and agentic interactions into a proprietary SOC data advantage.