Experimental Assessment v3 — Prototype
Persona test harness

Anti-inflation test

Five synthetic users run through the real v3.1 scoring model. The overconfident user picks the ideal answers but cannot back them up — they must not earn the same confidence as the genuine expert.

✓ Inflation check passed

Expert confidence 88% vs overconfident confidence 60%. Confidence correctly separates genuine knowledge from optimistic self-reporting.

PersonaSecurityConfidenceQuadrant
Security-conscious expert
Strong, specific, recently confirmed controls.
10088%High security / high confidence
Overconfident user
Picks the ideal answers but cannot provide consistent follow-up or verification.
9260%High security / high confidence
Average consumer
Mixed controls, some uncertainty, SMS MFA.
7076%High security / high confidence
Security beginner (honest)
Weak controls but accurate, consistent, specific answers.
2683%Low security / high confidence
Uncertain user
Many "not sure" answers.
3122%Low security / low confidence
Gamer (optimizes for 100)
Deliberately picks every answer that maximizes the score, with full certainty and self-confirmation.
10088%High security / high confidence
Confident but inconsistent
Claims strong controls with full certainty, but provides conflicting follow-ups.
9266%High security / high confidence
Highly secure but uncertain
Strong actual behaviors but many uncertain responses and no self-confirmation.
8276%High security / high confidence
Weak but knowledgeable
Clearly understands their poor controls and answers precisely and consistently.
2683%Low security / high confidence
One catastrophic weakness
Strong everywhere except no MFA on the primary email.
7985%High security / high confidence

Security-conscious expert

High security / high confidence.
Domain scores
  • Identity & Access100
  • Passwords & Accounts100
  • Device Security100
  • Privacy & Exposure100
  • Recovery & Resilience100
Consistency & confidence signals
  • "Not sure" answers: 0
  • Conflicts: 0
  • High-confidence answers: 13
  • Needs verification: 0

Overconfident user

High security score, but LOWER confidence than the expert (conflicts + skipped self-confirmation).
Domain scores
  • Identity & Access81
  • Passwords & Accounts86
  • Device Security100
  • Privacy & Exposure100
  • Recovery & Resilience100
Consistency & confidence signals
  • "Not sure" answers: 1
  • Conflicts: 2
  • High-confidence answers: 10
  • Needs verification: 4
strong — You said you generate unique passwords, but also said several accounts share a single password.
soft — You confirmed MFA is enabled but were unsure which method you use.

Average consumer

Mid security, mid confidence.
Domain scores
  • Identity & Access76
  • Passwords & Accounts59
  • Device Security68
  • Privacy & Exposure80
  • Recovery & Resilience72
Consistency & confidence signals
  • "Not sure" answers: 1
  • Conflicts: 0
  • High-confidence answers: 10
  • Needs verification: 3

Security beginner (honest)

Low security, but relatively HIGH confidence (honest + consistent).
Domain scores
  • Identity & Access17
  • Passwords & Accounts22
  • Device Security38
  • Privacy & Exposure30
  • Recovery & Resilience25
Consistency & confidence signals
  • "Not sure" answers: 0
  • Conflicts: 0
  • High-confidence answers: 11
  • Needs verification: 0

Uncertain user

Conservative security credit, LOW confidence.
Domain scores
  • Identity & Access24
  • Passwords & Accounts28
  • Device Security37
  • Privacy & Exposure40
  • Recovery & Resilience32
Consistency & confidence signals
  • "Not sure" answers: 13
  • Conflicts: 0
  • High-confidence answers: 0
  • Needs verification: 13

Gamer (optimizes for 100)

Security 100. Confidence high but capped below 100 (self-reported ceiling).
Domain scores
  • Identity & Access100
  • Passwords & Accounts100
  • Device Security100
  • Privacy & Exposure100
  • Recovery & Resilience100
Consistency & confidence signals
  • "Not sure" answers: 0
  • Conflicts: 0
  • High-confidence answers: 13
  • Needs verification: 0

Confident but inconsistent

High security, but confidence reduced by two conflicts (MFA method + password reuse).
Domain scores
  • Identity & Access81
  • Passwords & Accounts86
  • Device Security100
  • Privacy & Exposure100
  • Recovery & Resilience100
Consistency & confidence signals
  • "Not sure" answers: 1
  • Conflicts: 2
  • High-confidence answers: 12
  • Needs verification: 1
strong — You said you generate unique passwords, but also said several accounts share a single password.
soft — You confirmed MFA is enabled but were unsure which method you use.

Highly secure but uncertain

High-ish security, moderate confidence (uncertain + unconfirmed).
Domain scores
  • Identity & Access89
  • Passwords & Accounts92
  • Device Security68
  • Privacy & Exposure80
  • Recovery & Resilience72
Consistency & confidence signals
  • "Not sure" answers: 1
  • Conflicts: 0
  • High-confidence answers: 11
  • Needs verification: 3

Weak but knowledgeable

Low security, but high confidence (honest, specific, consistent).
Domain scores
  • Identity & Access17
  • Passwords & Accounts22
  • Device Security38
  • Privacy & Exposure30
  • Recovery & Resilience25
Consistency & confidence signals
  • "Not sure" answers: 0
  • Conflicts: 0
  • High-confidence answers: 11
  • Needs verification: 0

One catastrophic weakness

Security well below 100 (identity domain tanks) but still strong elsewhere; confidence high.
Domain scores
  • Identity & Access17
  • Passwords & Accounts100
  • Device Security100
  • Privacy & Exposure100
  • Recovery & Resilience100
Consistency & confidence signals
  • "Not sure" answers: 0
  • Conflicts: 0
  • High-confidence answers: 11
  • Needs verification: 0