Understanding phishing discussions on stack overflow and information security stack exchange

Abstract

Abstract Phishing remains a prevalent cybersecurity threat. Given its impact, it is important to understand how technically skilled users interpret and respond to such threats. This paper examines how developers and security professionals discuss phishing on Stack Overflow (SO) and Information Security (IS) Stack Exchange in order to understand their concerns, pain points, and investigative practices. We qualitatively analyzed 140 phishing-related questions (60 from SO and 80 from IS) using inductive open coding and developed the Developer Phishing Engagement Framework, which organizes developer activities into four layers: prevention, detection and reporting, mitigation, and planning. Across the two platforms, we find complementary emphases: SO posts focus on implementation hurdles, false positives, and the usability of defenses, whereas IS posts concentrate on post-incident analysis, impact, and ethical considerations around phishing simulations. Developers demonstrate a strong threat mindset but still face workflow friction caused by inconsistent organizational practices, opaque anti-phishing tools, and security measures that conflict with legitimate workflows. Our findings contribute a developer-centered view of phishing that complements existing user-focused models and provides guidance for designing more realistic anti-phishing tools, training, and organizational policies.