← Back to blog
·6 min read

What's Coming in Threat Terminal v2

What is changing in Threat Terminal v2: complete UI overhaul, persistent progression, daily challenges, ranked PvP, badges, and a coin economy.

ShareLinkedInX

Threat Terminal started as a question: when AI eliminates bad grammar as a detection signal, which phishing techniques actually fool people? The game, the XP system, the retro terminal aesthetic, all of it exists to get people to classify emails without it feeling like a compliance exercise. Over 100 participants have contributed data to a published study protocol and the early findings on fluent prose bypass rates have been worth sharing.

v2 is the biggest change since launch. Here is what is coming.

Complete UI overhaul

Every screen in Threat Terminal has been redesigned. The home screen now shows your level, XP progress, rank, badge count, and available game modes in one view. Navigation between modes is immediate. The layout scales properly on mobile. The whole interface feels like a game that takes itself seriously rather than a research tool wearing a retro skin.

This is not a reskin. The information architecture changed. v1 dropped you into a session and showed results after. v2 gives you a persistent home base with clear paths to each mode: Research, PvP, Daily, and Freeplay. Modes unlock progressively as you contribute research answers, so the home screen starts focused and expands as you play.

Threat Terminal v2 home screen showing level progression, game modes, and leaderboard

Expanded progression

v1 had XP and levels. v2 expands on it. The level curve caps at level 30 around 37,700 XP with ten rank tiers tied to level thresholds: CLICK_HAPPY, PHISH_BAIT, LINK_CHECKER, HEADER_READER, SOC_ANALYST, THREAT_HUNTER, INCIDENT_HANDLER, RED_TEAMER, APT_ANALYST, and ZERO_DAY. XP milestone rewards at research answer thresholds give bonus payouts for contributing to the study. The leaderboard now separates XP, PvP, and Daily tabs so different playstyles each have a ladder to climb.

Daily challenges

Every day, all players receive the same seeded 10-card deck. A separate daily leaderboard ranks everyone who completed that day's challenge. Every player on the same day sees the same cards in the same order. If one player scores higher than another on the same deck, the difference is detection ability, not card variance.

Freeplay and expert mode

After completing 30 research answers, Freeplay unlocks with cards from the full pool including expert-difficulty content. Expert cards carry double XP for every answer. Play as many rounds as you want with no research constraints. Experienced players start recognizing patterns in a 1,000-card pool. Expert cards give them fresh, harder content without contaminating the study data.

Ranked PvP

PvP mode is entirely new in v2. Five-card speed rounds where a wrong answer eliminates you and the fastest perfect run wins. A seven-tier ranked ladder from Bronze through Elite tracks your competitive standing across seasons, separate from your research XP.

Win streaks, match history, and a visible climb through the ranked tiers give competitive players a reason to keep queuing.

Threat Terminal v2 PvP mode showing ranked tiers, match stats, and season tracking

Badges

v2 introduces a badge system with 38 badges at launch. Badges are earned through gameplay milestones: first correct answer, win streaks, research contributions, PvP achievements, speed records, and more. Your profile displays up to five badges on a shelf, and the first badge in your shelf becomes your PvP display badge.

Badges like FOUNDER (early adopter), DEAD_CERTAIN (high confidence accuracy), SPEED_DEMON (fast classification), and RESEARCH_GRADUATE (completing the study protocol) give players visible proof of how they play, not just how much.

Player profiles and social features

Public player profiles with bio, privacy controls (public, friends-only, or private), and the badge shelf. A friends system with incoming and outgoing request management lets you track people from the leaderboard and compare stats directly.

Threat Terminal v2 player profile with badge shelf, privacy settings, and friends tab

Inventory and shop

v1 had unlockable color themes. v2 consolidates them into a proper inventory system alongside badges. Themes like Phosphor (classic green), Amber CRT (vintage warmth), Frost Bite (cold recon blue), Phantom (stealth mode), Red Team (offensive operations red), and Ghost Protocol (unlocked at level 28) now live in a unified inventory with tabs for themes, badges, and a shop.

The shop is coming in Season 1. The plan is a free-to-play coin economy: earn coins through gameplay, spend them on cosmetics. No microtransactions, no paid currency. The inventory system for themes and badges is live now; the coin economy is next.

Threat Terminal v2 inventory showing unlockable terminal themes

Quests

v2 adds a quest system designed to guide players toward the behaviors that generate the most useful research data. Quests reward XP for hitting research answer milestones. Three quests guide new players through the unlock progression: 10 answers unlocks PvP (100 XP), 20 unlocks Daily Challenge (200 XP), and 30 unlocks Freeplay (500 XP). Each quest card expands to show what it requires and why it matters.

The unlock gates serve double duty. They ensure every player contributes a baseline of research data before accessing competitive and unranked modes, and they give new players a clear path forward instead of dumping every mode on the home screen at once.

Forensic signal changes

v1 showed email authentication headers (SPF, DKIM, DMARC), Reply-To fields, and send timestamps during gameplay. v2 removes them. The early findings showed these signals were creating confounds: authentication headers acted as a near-deterministic shortcut on easier cards, Reply-To was only populated on phishing cards (making it a binary classifier), and send timestamps were inconsistently populated across the deck.

Players can still inspect URLs and tap sender addresses to reveal the full email. The change strips out the signals that were doing the thinking for players and forces classification based on the email content itself.

What stays the same

The core research methodology is unchanged. Every card is still AI-generated. Writing quality is still held constant across conditions. Technique is still the only independent variable. The 1,000-card research dataset is intact. Research Mode still collects the same pseudonymous telemetry per answer with no PII in the research tables.

v2 does not change what Threat Terminal measures. It changes how long people are willing to sit down and be measured.

When

v2 launches this weekend. The live version is still running v1 and collecting data. When v2 goes live, existing player data carries over.

If you want to get ahead of it, play the current version now. Your sessions still count toward the study, and your progress will be there when v2 lands.

More posts

·18 min read

The Action Pause: A 10-Second Habit for AI-Era Impersonation

A behavioral framework for AI-era impersonation across email, voice, video, chat, and in-person asks. Empirically grounded in 2,511 classifications from the Threat Terminal study. Trigger on the action request, not on the content.

·31 min read

Preliminary Findings: How Humans Detect AI-Generated Phishing Across 2,511 Classifications

Findings from 153 participants classifying AI-generated phishing: technique-level bypass rates, overconfidence patterns, and what security training misses.

·4 min read

Threat Terminal v2.0: PvP Is Here

Real-time 1v1 ranked matches, a new unlock ladder, and a terminal AI that will not stop talking. Threat Terminal v2.0 goes live tonight.

Stay in the loop

I write about the security topics that interest me: IAM, cloud security, automation, threat intelligence, phishing, and incident response. If this was useful, there is more where it came from.