Synthetic phishing remediation dataset

What you can build and check

• Load incident tickets into a local case-management prototype.
• Check ingestion, field mapping, search, and case-detail rendering.
• Experiment with summarizing incident notes while retaining evidence and closure conditions; assess outputs yourself.

These are suggested uses to validate in your own prototype. No integration with a specific vendor product or model-performance improvement is claimed.

One actual preview record

This record comes from the public preview. Names, companies, and identifiers are fictional.

{
  "employee_name": "Kendra Morales",
  "sender_address": "notice-10799@security-example.invalid",
  "subject_line": "Document Sharing Lure",
  "containment_action": "The 2026-06-11 review for Kendra Morales concerns shared document notification redirecting users to a credential-harvesting landing page. Assessment of the redirect chain and document-sharing audit trail supports the instruction to revoke affected sessions if credentials were submitted. A status update arrived through a secondary contact and awaits confirmation from the accountable owner. Checklist item 9 remains open in the follow-up queue. The case includes an exception request that requires approval separate from the routine workflow. Closure requires that identity review confirms the account is secured; an incomplete evidence request keeps the case open.",
  "incident_notes": "The assigned reviewer considered shared document notification redirecting users to a credential-harvesting landing page for Kendra Morales on 2026-06-11. Collect the redirect chain and document-sharing audit trail and revoke affected sessions if credentials were submitted, recording any unresolved limitation. A later message narrows the original request to the affected service rather than the entire account. The working file for resolution retains attachment 17 alongside the original report. A review note distinguishes directly observed facts from information attributed to another person. The handoff specifies this completion condition: identity review confirms the account is secured.",
  "ticket_id": "SECU-2026-14644753"
}

Browse the preview file · Read the full dataset card

Try it locally

1. Download the 10K preview as demo.jsonl.
2. Download inspect_preview.py into the same folder.
3. Run this command with Python 3. It uses the standard library, makes no API calls, checks fields and unique IDs, and exports the same records to a CSV you can inspect or import.

python inspect_preview.py --dataset phishing_remediation_reports --file demo.jsonl --csv demo-cases.csv

The printed summary shows the loaded count, fields, subject_line counts, and first record. This is a format and inspection example, not a model benchmark. Free-preview use remains subject to its existing non-commercial license.

Schema and scenario coverage

The free and paid tiers use the same schema and these six configured scenario families:

• Password reset impersonation
• Invoice impersonation
• Benefits attachment lure
• Shipping link lure
• Document sharing lure
• Bank suspension impersonation

More rows provide additional synthetic variants, not 100,000 independent real-world cases or additional workflow families.

Free versus paid

The paid package suits a larger set of workflow fixtures and use under the existing commercial terms. Evaluate the free preview first; a larger record count alone does not prove better model performance. This purchase covers one selected dataset.

Quality evidence and limits

Both tiers scored 94/100 in the project's automated audit on 13 October 2026. The paired verification found zero exact record or ID overlap between the free and paid tiers. Similarity checks are bounded. The score is an internal record-quality measure.

The records contain incident narratives and containment actions, not full email bodies, EML files, benign/phishing labels, live threat feeds, or executable tool-call trajectories. They do not establish phishing-detector accuracy.

Read the public quality audit. Inspect fit before buying. No independent train/test benchmark or real-world transfer result is provided.

How purchase and delivery work

1. Open this dataset's commercial access page.
2. Enter your Hugging Face username. A Hugging Face account is required for private repository delivery; create an account if needed.
3. Pay through Lemon Squeezy. The existing fulfillment flow grants access to the matching private repository after payment.

For delivery questions, contact xomohappy on Discord. Review terms, privacy, and refund policy before purchase.