SC
Sarah Chen
Finance Manager
WHY TARGETEDFinancial access
Use cases / Human-layer honeypots
Let the attack
come to us.
Place synthetic identities and controlled attack surfaces where modern campaigns begin and pivot—from social engineering and identity abuse to web, edge, cloud, and agentic workflows.
Built forSecurity teamsThreat intelligenceSecurity engineeringFraud teamsCISOsRisk leaders
01 / Phishing
Look beyond the message.
Traditional controls inspect the email. A synthetic persona can create an opportunity to observe what the attacker does next—without placing a real employee in the conversation.
Account verificationCredential solicitationMalicious linksInvoice fraudExecutive impersonationFake support
Possible intelligence
SenderDomainLinkClaimed identityRequested actionConversation behavior
To: Sarah Chen <sarah.chen@northstar.example>
Action required: invoice account verification
Hi Sarah,
We couldn't process invoice NS-10482. Please verify your account details before today's payment window closes.
Accounts Payable Team
Northstar Vendor Services
Synthetic example scenario
02 / Vishing
Hear the pretext evolve.
A governed voice interaction exposes more than caller ID: the claim, request, language, infrastructure, and behavioral changes that emerge when a story is challenged.
Governed voice agents keep the synthetic persona consistent, refuse sensitive disclosures, preserve evidence, and keep analysts in control while the attacker reveals more of the pretext.
Extracted intelligence
Phone numberClaimed identityRequested actionLanguagePretextBehavioral patternPossible campaign
INBOUND / UNKNOWN+1 (312) 555-0184
EngagedClaimCaller claims to be IT Support.
RequestRequests approval of an MFA prompt.
BehaviorChanges story after being challenged.
ArtifactProvides a callback number.
03 / Smishing
Follow the thread.
A synthetic mobile identity lets teams study malicious links, fake invoices, account alerts, delivery scams, credential requests, and the follow-up behavior that turns one message into a campaign.
Malicious linksFake invoicesAccount alertsDelivery scamsCredential requestsFollow-up behavior
9:415G
NS
Northstar AlertsUnknown senderNorthstar: Your payroll account has been restricted. Confirm your details: nstar-secure.co/r/82a
Which account is affected?
Your employee deposit profile. Complete verification within 30 minutes to avoid suspension.
Message
05 / Executive & finance targeting
Attackers choose people, not inboxes.
Attackers select people based on role, authority, access, and organizational relationships. stickysweet builds coherent synthetic identities around the roles they seek.
EP
Emily Parker
Executive Assistant
WHY TARGETEDOrganizational relationships
MT
Michael Torres
IT Administrator
WHY TARGETEDSystem access
06 / Full attack stack
See the campaign around the conversation.
The initial lure is only one layer. stickysweet turns human, identity, application, edge, network, infrastructure, and agentic observations into one dataset so the SOC can understand how access is being attempted and what the adversary is likely to reuse.
Identity & authentication
Password spraying · MFA manipulation · device-code phishing · credential replay · canary credential use
Web & edge
Reconnaissance · exposed service probing · exploit attempts · automated scanning · application-path discovery
Network & infrastructure
Source IPs · ASN and geography · domains · relay infrastructure · protocol behavior · repeated origin patterns
Cloud, SaaS & agent workflows
Cloud identity abuse · SaaS pretexts · AI-agent interactions · prompt-driven workflows · malicious integrations
The data advantage comes from correlation: a voice pretext, SSO attempt, web probe, source network, and reused domain can become one campaign instead of five unrelated alerts.
07 / Agentic threats
When the attacker isn't human.
Agentic systems can research organizations, discover identities, enumerate channels, scan applications, chain tools, personalize outreach, manipulate authentication, adapt to defensive responses, and coordinate multi-stage operations with far less human effort.
stickysweet is deception infrastructure for an environment where the entity approaching a synthetic employee may itself be an AI agent—and where defenders need agentic analysis operating across the same campaign timeline.
The same model captures agentic reconnaissance, AI-personalized social engineering, automated authentication probing, web and edge activity, and repeated infrastructure reuse across the full attack sequence.
UNKNOWN ENTITYAutonomous agentBehavior under observation
01Research organization
02Discover identity
03Enumerate channels
04Probe web / edge
05Manipulate authentication
06Adapt social engineering
07Chain follow-on actions
Campaign intelligence
These are not three independent alerts.
Three alerts can be one adversary. stickysweet correlates persona, identity, edge, infrastructure, and behavioral signals into one campaign view so the SOC sees the operation—not just the events.
SC
Sarah Chen
Finance Manager
VoiceHelpdesk impersonationMFA approval requested
MT
Michael Torres
IT Administrator
SSOCanary credential usedAuthentication attempt
EP
Emily Parker
Executive Assistant
EmailAccount security lureCredential reset requested
Actor 81AC · Active campaign
High confidenceAI-augmented helpdesk intrusion chain
7Targeted personas
24Correlated events
Voice · Email · SSO · WebSurfaces
18 minObserved sequence
Synthetic example data · Cross-sensor campaign correlation
For MSSPs & security partners
Turn proprietary telemetry into a managed advantage.
Run repeatable synthetic identity and sensor programs across customer environments while preserving tenant boundaries, campaign context, and the data each SOC needs to hunt and respond.
Deploy standardized persona and sensor patterns across customers while keeping company, cluster, and telemetry boundaries clear.
Route high-confidence interactions, evidence, and campaign intelligence into SIEM, SOAR, hunting, and incident-response workflows.
Study infrastructure reuse, agentic tradecraft, cross-channel behavior, and emerging attack patterns across controlled observation programs.
From interaction to full-stack intelligence
Every touchpoint
reveals something.
01Contact
02Identity
03Web / Edge
04Infrastructure
05Actor
06Campaign