I am developing an application that will be used for computer security training, specifically for awareness of scams and phishing.
As part of this, I plan to use a series of well-known company brand names and trademarks (e.g. Stack Exchange) in order to create examples and demos that the user can relate to.
For example, I may demonstrate how a scammer can use a slightly altered domain name in order to create a convincing scam website, with the goal of educating users of this risk.
As far as I can tell, the use of company brand names and trademarks for this purpose is considered a transformative use, which would therefore be protected under copyright fair use.
However, there is a risk of causing user confusion or diluting brands, for example if a user doesn't understand that a particular demo is fictional, and not an actual scam. I understand that I can mitigate this with a clearly marked disclaimer and instructions.
What would be the legality of this, and are there any risks or mitigations that I haven't considered? For reference I am based in the UK, however the app will be globally accessible and may use trademarks registered in many different countries.
