> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Human-facing layer (HF)

- URL: /taxonomies/email-infrastructure/human-facing-layer/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T14:54:24.326Z
- Description: Human-facing layer (HF): 13 threats in the email infrastructure threat taxonomy. What the client and platform present to the person reading or sending.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › Human-facing layer

**Layer 08 of 09 · 13 threats · prefix HF**

The interface decides which facts about a message a person sees before they act on it. These entries cover what the client and the platform present, and the decisions the design leaves to the user.

**Scope:** What the client and platform present to the person reading or sending.

![Table: Human-facing layer (HF), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/101/email-taxonomy-table-08-HF.png =1400x3535)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="hf-a"></span>**HF·A** Display Name Deception
- <span id="hf-k"></span>**HF·K** Lookalike Rendering
- <span id="hf-q"></span>**HF·Q** Thread Hijack
- <span id="hf-j"></span>**HF·J** Indicator Spoofing
- <span id="hf-10"></span>**HF·10** Reply-Path Diversion
- <span id="hf-9"></span>**HF·9** Link Presentation Mismatch
- <span id="hf-8"></span>**HF·8** Warning Fatigue
- <span id="hf-7"></span>**HF·7** Trusted Internal Sender
- <span id="hf-6"></span>**HF·6** Platform Feature Mimicry
- <span id="hf-5"></span>**HF·5** Auto-Added Content
- <span id="hf-4"></span>**HF·4** Assistant-Mediated Deception
- <span id="hf-3"></span>**HF·3** Signal Loss in Compact Views
- <span id="hf-2"></span>**HF·2** Misdirected Send

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 8 cleanly and 5 only loosely. CAPEC 3.9 has a pattern that describes 1 of them directly, only a generic parent pattern for 8, and nothing for 4. CWE 4.20 names the weakness directly for 6, has only a broader weakness for 7,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Human-facing layer (HF), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/101/email-mapping-table-08-HF.png =1400x2171)

---

← [Content scanners (CS)](/taxonomies/email-infrastructure/content-scanners/) · [Email infrastructure overview](/taxonomies/email-infrastructure/) · [Operations and storage (OP)](/taxonomies/email-infrastructure/operations-and-storage/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*