When the Rules of Engagement say the red team owns the full campaign chain, “we used a hosted simulation tool with third-party mail” stops being an answer.
Poseidon-X exists because campaign infrastructure has to survive scrutiny from the customer, compliance, and the operator who has to explain where every email came from. It started as a hardened GoPhish fork and grew into a multi-host platform: admin server, landing listener, file host, and SMTP host, each registered and managed as operator-controlled infrastructure.
The design constraint is sovereignty. Your IP reputation. Your DKIM. Your delivery path. Your audit trail. No third-party CDN, analytics, or telemetry calls are baked into the product. Outbound network activity is limited to operator-triggered flows with offline fallbacks, and operator actions land in an append-only audit log.
The result is adversary-emulation infrastructure rather than a demo stack: campaign management, per-recipient tracking modes, deliverability preflight, React analytics, and pure-Go reports for engagements where the paperwork matters.