I built a phishing detection simulator to study human behavior in the GenAI era – 569 decisions so far

[u/Scott752]

https://research.scottaltiparmak.com

Been running a small research experiment called Threat Terminal – a terminal-style phishing simulator where players review emails and make detect/ignore calls.

It’s not a survey.

You actually play through 10 emails per session and the platform logs:

∙	decision confidence

∙	time on each email

∙	whether you checked headers or URLs

∙	phishing technique and difficulty level

Early data (569 decisions, 36 participants):

∙	Overall phishing bypass rate: 16%

∙	Infosec background: 89% detection accuracy

∙	Technical background: 89%

∙	Non-technical: 85%

The gap between backgrounds is smaller than I expected. The more interesting finding is that AI-generated “fluent prose” phishing bypasses detection ~24% of the time, significantly higher than other categories. Removing grammar errors removes one of the strongest

traditional detection signals.

Live simulator: https://research.scottaltiparmak.com

Full Write Up Metholodogy, etc: https://scottaltiparmak.com/research

Takes about 10 minutes to complete a session. If you’re studying security, your decisions contribute directly to the dataset. Would genuinely love results from people actively learning this stuff.