# Understanding phishing discussions on stack overflow and information security stack exchange

## TL;DR

This paper explores how developers and security professionals discuss phishing on Stack Overflow and Information Security Stack Exchange to understand their challenges and approaches.

## Contribution

The study introduces the Developer Phishing Engagement Framework, offering a new perspective on phishing from a developer-centric viewpoint.

## Key findings

- Stack Overflow discussions focus on implementation issues and usability of phishing defenses.
- Information Security Stack Exchange emphasizes post-incident analysis and ethical concerns.
- Developers face workflow friction due to inconsistent practices and opaque security tools.

## Abstract

Phishing remains a prevalent cybersecurity threat. Given its impact, it is important to understand how technically skilled users interpret and respond to such threats. This paper examines how developers and security professionals discuss phishing on Stack Overflow (SO) and Information Security (IS) Stack Exchange in order to understand their concerns, pain points, and investigative practices. We qualitatively analyzed 140 phishing-related questions (60 from SO and 80 from IS) using inductive open coding and developed the Developer Phishing Engagement Framework, which organizes developer activities into four layers: prevention, detection and reporting, mitigation, and planning. Across the two platforms, we find complementary emphases: SO posts focus on implementation hurdles, false positives, and the usability of defenses, whereas IS posts concentrate on post-incident analysis, impact, and ethical considerations around phishing simulations. Developers demonstrate a strong threat mindset but still face workflow friction caused by inconsistent organizational practices, opaque anti-phishing tools, and security measures that conflict with legitimate workflows. Our findings contribute a developer-centered view of phishing that complements existing user-focused models and provides guidance for designing more realistic anti-phishing tools, training, and organizational policies.