When the Rules of Engagement say the red team owns the full campaign chain, “we used a hosted simulation tool with third-party mail” stops being an answer.
Poseidon-X exists because campaign infrastructure has to survive scrutiny from the customer, compliance, and the operator who has to explain where every email came from. It started as a hardened GoPhish fork and grew into a multi-host platform: admin server, landing listener, file host, and SMTP host, each registered and managed as operator-controlled infrastructure.
The design constraint is sovereignty. Your IP reputation. Your DKIM. Your delivery path. Your audit trail. No third-party CDN, analytics, or telemetry calls are baked into the product. Outbound network activity is limited to operator-triggered flows with offline fallbacks, and operator actions land in an append-only audit log.
Wraith is the platform’s email authentication assessment layer — formerly a standalone project, now integrated into Poseidon-X. It inspects a domain’s MX, SPF, and DMARC records without sending mail, builds clearly labeled proof-of-concept messages, and preserves the evidence: generated .eml files, JSON result records, and full SMTP transcripts. By default, delivery attempts are dry-run; live direct-to-MX proofs require explicit operator confirmation and approved outbound access. Wraith Console provides passive DNS review, sender discovery, audience import, and campaign design through the same operator-facing stack as the rest of the platform.
The result is adversary-emulation infrastructure rather than a demo stack: campaign management, per-recipient tracking modes, deliverability preflight, email auth assessment, React analytics, and pure-Go reports for engagements where the paperwork matters.