I am developing an application that will be used for computer security training, specifically for awareness of scams and phishing.


As part of this, I plan to use a series of well-known company brand names and trademarks (e.g. `Stack Exchange`) in order to create examples and demos that the user can relate to.


For example, I may demonstrate how a scammer can use a slightly altered domain name in order to create a convincing scam website, with the goal of educating users of this risk.


As far as I can tell, the use of company brand names and trademarks for this purpose is considered a transformative use, which would therefore be protected under copyright fair use.


However, there is a risk of causing user confusion or diluting brands, for example if a user doesn't understand that a particular demo is fictional, and not an actual scam. I understand that I can mitigate this with a clearly marked disclaimer and instructions.


What would be the legality of this, and are there any risks or mitigations that I haven't considered? For reference I am based in the UK, however the app will be globally accessible and may use trademarks registered in many different countries.



What are the legal considerations of using trademarks in security training material?