← Back to blog
·6 min read

What's Coming in Threat Terminal v2

A walkthrough of what is changing in Threat Terminal v2. Complete UI overhaul, persistent progression, daily challenges, ranked PvP, badges, an inventory and shop, and a free-to-play coin economy.

ShareLinkedInX

Threat Terminal started as a question: when AI eliminates bad grammar as a detection signal, which phishing techniques actually fool people? The game, the XP system, the retro terminal aesthetic, all of it exists to get people to classify emails without it feeling like a compliance exercise. Over 100 participants have contributed data to a published study protocol and the early findings on fluent prose bypass rates have been worth sharing.

v2 is the biggest change since launch. Here is what is coming.

Complete UI overhaul

Every screen in Threat Terminal has been redesigned. The home screen now shows your level, XP progress, rank, badge count, and available game modes in one view. Navigation between modes is immediate. The layout scales properly on mobile. The whole interface feels like a game that takes itself seriously rather than a research tool wearing a retro skin.

This is not a reskin. The information architecture changed. v1 dropped you into a session and showed results after. v2 gives you a persistent home base with clear paths to each mode: Research, Freeplay, PvP, and Daily. You always know where you are and what you have unlocked.

Threat Terminal v2 home screen showing level progression, game modes, and leaderboard

Expanded progression

v1 had XP and levels. v2 expands on it. The level curve now caps at level 30 around 14,000 XP with five rank tiers from NOVICE through ELITE tied to level thresholds. XP milestone rewards at research answer thresholds give bonus payouts for contributing to the study. The leaderboard now separates XP, PvP, and Daily tabs so different playstyles each have a ladder to climb.

Daily challenges

Every day, all players receive the same seeded 10-card deck. One attempt per day. A separate daily leaderboard ranks everyone who completed that day's challenge.

Every player on the same day sees the same cards in the same order. If one player scores higher than another on the same deck, the difference is detection ability, not card variance.

Freeplay and expert mode

Freeplay is the unranked sandbox. Play as many rounds as you want with no research constraints. After completing 10 research sessions, expert-difficulty cards unlock inside Freeplay: extreme-difficulty content that sits outside the standard research dataset with double XP for every answer. Experienced players start recognizing patterns in a 1,000-card pool. Expert cards give them fresh, harder content without contaminating the study data.

Ranked PvP

PvP mode has been rebuilt from the ground up. Five-card speed rounds where a wrong answer eliminates you and the fastest perfect run wins. A seven-tier ranked ladder from Bronze through Elite tracks your competitive standing across seasons, separate from your research XP.

Win streaks, match history, and a visible climb through the ranked tiers give competitive players a reason to keep queuing. The timeout issues from v1 matchmaking are gone.

Threat Terminal v2 PvP mode showing ranked tiers, match stats, and season tracking

Badges

v2 introduces a badge system with 37 badges at launch. Badges are earned through gameplay milestones: first correct answer, win streaks, research contributions, PvP achievements, speed records, and more. Your profile displays up to five badges on a shelf, and the first badge in your shelf becomes your PvP display badge.

Badges like FOUNDER (early adopter), DEAD_CERTAIN (high confidence accuracy), SPEED_DEMON (fast classification), and RESEARCH_GRADUATE (completing the study protocol) give players visible proof of how they play, not just how much.

Player profiles and social features

Public player profiles with bio, privacy controls (public, friends-only, or private), and the badge shelf. A friends system with incoming and outgoing request management lets you track people from the leaderboard and compare stats directly.

Threat Terminal v2 player profile with badge shelf, privacy settings, and friends tab

Inventory and shop

v1 had unlockable color themes. v2 consolidates them into a proper inventory system alongside badges. Themes like Phosphor (classic green), Amber CRT (vintage warmth), Frost Bite (cold recon blue), Phantom (stealth mode), Red Team (offensive operations red), and Ghost Protocol (unlocked at level 28) now live in a unified inventory with tabs for themes, badges, and a shop.

The shop is where you spend coins earned through gameplay on cosmetics. The economy is entirely free-to-play. No microtransactions, no paid currency. You earn coins by playing and spend them on things that look cool. That is the whole model.

Threat Terminal v2 inventory showing unlockable terminal themes

Quests

v2 adds a quest system designed to guide players toward the behaviors that generate the most useful research data. Quests reward XP for completing research sessions, hitting answer milestones, trying different game modes, and maintaining streaks. Each quest card expands to show what it requires and why it matters.

The goal is not to gamify for its own sake. The study needs a specific volume and distribution of responses to produce meaningful results. Quests nudge players toward the actions that contribute most, like completing full research sessions or returning on consecutive days, without making it feel like a checklist.

Forensic signal changes

v1 showed email authentication headers (SPF, DKIM, DMARC), Reply-To fields, and send timestamps during gameplay. v2 removes them. The early findings showed these signals were creating confounds: authentication headers acted as a near-deterministic shortcut on easier cards, Reply-To was only populated on phishing cards (making it a binary classifier), and send timestamps were inconsistently populated across the deck.

Players can still inspect URLs and tap sender addresses to reveal the full email. The change strips out the signals that were doing the thinking for players and forces classification based on the email content itself.

What stays the same

The core research methodology is unchanged. Every card is still AI-generated. Writing quality is still held constant across conditions. Technique is still the only independent variable. The 1,000-card research dataset is intact. Research Mode still collects the same pseudonymous telemetry per answer with no PII in the research tables.

v2 does not change what Threat Terminal measures. It changes how long people are willing to sit down and be measured.

When

v2 launches this weekend. The live version is still running v1 and collecting data. When v2 goes live, existing player data carries over.

If you want to get ahead of it, play the current version now. Your sessions still count toward the study, and your progress will be there when v2 lands.

More posts

·5 min read

Fluent Prose: The Phishing Technique Security Training Ignores

Early findings from Threat Terminal show that phishing emails with no urgency, no threats, and no red flags bypass humans at roughly three times the rate of credential harvesting. Security training has the emphasis backwards.

·6 min read

Pilot Data: Which Phishing Techniques Actually Fool People?

Pilot data from 56 participants and 817 classifications in Threat Terminal reveals which phishing techniques humans miss most when AI eliminates writing quality as a signal.

·6 min read

What Happens When AI Makes Every Phishing Email Perfect?

AI has eliminated the grammar errors, awkward phrasing, and broken formatting that phishing training taught people to look for. The detection problem is now fundamentally different.

Stay in the loop

I write about the security topics that interest me: IAM, cloud security, automation, threat intelligence, phishing, and incident response. If this was useful, there is more where it came from.