SC
Sarah Chen
Finance Manager
VoiceClaimed IT supportMFA request
Honeypots for the agentic era
Give attackers
someone to talk to.
stickysweet is persona-first deception: synthetic identity infrastructure for understanding how adversaries approach people across email, voice, messaging, and social channels.
Human-layer honeypots. Proprietary adversary telemetry for teams that want a security data advantage.
SC
Active persona
Sarah Chen
Finance Manager · Chicago
EmailVoiceSMSSocial
10:42 AM · VoiceEngaged
Incoming call claiming to be Northstar IT.
Interaction modeled
Caller requested MFA reset.
Intent revealed
Caller asked Sarah to read back an authentication code.
ClassificationVishing
Confidence96%
Actor81AC
A new deception layer
The honeypot is a person.
Instead of waiting for an attacker to discover a server, put a believable synthetic identity into the world and observe who approaches it.
01Persona
02Exposure
03Contact
04Conversation
05Adversary
06Campaign
Persona builder
Build someone worth approaching.
Believable deception starts with consistency across a person's identity, organization, assets, communications, relationships and digital footprint.
One coherent identity, not a collection of decoys.
PERSONA DOSSIERReady
SC
Sarah Chen
Finance Manager · Chicago
Northstar FinancialManagerDavid Kim
Identity readiness92%
Digital identity
Email
Phone
Microsoft 365
LinkedIn
Slack
Laptop
Company directory
Engagement direction
The trap talks back.
stickysweet is designed around governed persona interactions. The exchange below illustrates that product direction; it is not a live capability claim.
Attacker
Hi Sarah, this is Mark from IT. We detected a problem with your account.
Sarah
Hi Mark. What do you need me to do?
Attacker
I just sent you an authentication request. Can you approve it?
Illustrative fictional data · controlled conversation mockup
SystemMFA solicitation detected
Helpdesk impersonation
ExtractedPhone numberClaimed identityRequested actionInfrastructure
Multi-channel model
One identity. Across channels.
Email, voice, SMS, social, messaging, and agent interactions belong to one synthetic person. Channel availability is scoped with each program.
SC
Sarah ChenOne synthetic identityEmail
Voice
SMS
Social
Messaging
Agent
Security data advantage
Own threat telemetry other teams can’t buy.
Elite security teams use stickysweet to create a security data advantage: proprietary threat telemetry generated when adversaries engage with synthetic identities deployed across email, SSO, web, voice, and more.
Deploy synthetic identities where attackers operate. See who engages with them, how they move between channels, and what infrastructure they reuse.
01Your telemetry
Generated against your organization instead of purchased from the same commodity feeds as everyone else.
02Cross-channel context
Connect identity, infrastructure, tactics, and repeated contact across sensor types and synthetic personas.
03No ingest tax
Unlimited interaction telemetry. No per-event, per-log, or per-GB pricing that discourages collection.
Campaign intelligence
These are not three independent alerts.
Three alerts can be one adversary. The stickysweet intelligence model brings interactions together around the people approached, shared infrastructure, actors, and campaigns.
MT
Michael Torres
IT Administrator
SMSAccount verificationLink sent
EP
Emily Parker
Executive Assistant
EmailSecurity alertCredential reset request
Actor 81AC · Active campaign
High confidenceMicrosoft Helpdesk Impersonation
7Targeted personas
19Interactions
Voice · SMS · EmailChannels
Aug 11First observed
Shared indicators
Phone+1 (312) 555-0148
Domainlogin-secure-example.test
Emailsupport@example.test
Observed tactics
Fictional test data · Conceptual intelligence model, not automatic correlation
MSSP & cybersecurity collaboration
Build the observation network together.
We're interested in working with MSSPs, threat intelligence teams, security vendors, incident responders, and researchers who want to extend synthetic identity coverage or develop new ways to turn adversary interaction into useful security data.
Bring stickysweet into a managed service, connect it to an existing security stack, or collaborate on research, integrations, and new sensor coverage.
Deploy repeatable synthetic identity coverage for customer environments while preserving clear organizational and sensor boundaries.
Connect adversary telemetry into SIEM, SOAR, threat intelligence, detection engineering, and investigation workflows.
Explore campaigns, infrastructure reuse, cross-channel behavior, and emerging agentic attack patterns with controlled telemetry.
Operating model
How it works
01
Build the persona
Create a complete synthetic employee and digital identity.
02
Create exposure
Give the identity controlled presence across selected channels and systems.
03
Define engagement
Set the boundaries for how suspicious contact can be observed or engaged as capabilities become available.
04
Develop interaction intelligence
Organize observed actors, infrastructure, tactics, relationships, and campaign context.
Identity infrastructure
Deception starts with identity.
Believable engagement requires durable identity infrastructure: a governed system for who the persona is, where they exist, and how their history evolves.
01Persona lifecycle
02Identity readiness
03Asset inventory
04Identifiers
05Organizational relationships
06Assignment history
07Identity graph
08Activity records
09Governed access
Synthetic workforce
People your adversaries can meet.
SC
Persona readySarah Chen
Finance Manager
Email · Voice · SMSIllustrative activity
MT
Persona readyMichael Torres
IT Administrator
Email · Voice · SocialIllustrative activity
EP
ConceptEmily Parker
Executive Assistant
Voice · SMSInteraction model
Illustrative interface data, not customer statistics.
The conversation starts here
They think they've found an employee.
They've found stickysweet.
Synthetic people. Real adversaries.