Skip to main content
Use case · Coordinated attack detection

How do I tell if a wave of negative posts about my company is coordinated, and prove it?

Look at how the accounts behave, not at individual posts. Coordinated waves share signals: accounts created close together, synchronized posting, reused or lightly rewritten text, links to the same domains, and dense amplification within a small cluster, often traceable to one upstream post. Organic anger has many independent participants and an uneven shape. To prove it, document where the wave started, which accounts carried it, which of them were flagged as inauthentic, and whether it reached mainstream news. PeakMetrics flags coordinated behavior and bot networks and maps where a narrative started, so leadership sees evidence rather than an impression.

Last updated September 30, 2026

Who it is for

Built for

  • Communications and crisis teams facing a sudden spike of negative posts about the company
  • Risk, security and trust teams monitoring disinformation that targets the company or its executives
  • Comms leaders who need to show a CEO or board whether criticism is organic or manufactured
  • Agencies running crisis response for clients

Probably not for

  • Teams hoping to dismiss genuine criticism. If the wave is organic, the evidence will show that, and the right response is to deal with the complaint
  • Teams that need a legal finding of who sponsored a campaign from monitoring data alone
  • Teams whose main work is scheduling posts or answering customer-service messages, who may prefer a social management suite

How a team does this with PeakMetrics

  1. Know what normal looks like

    A spike is only measurable against a baseline. Set Narrative Velocity Alerts on the velocity or reach threshold that counts as unusual for your company, so the team hears about a wave when it starts rather than when a reporter calls.

  2. Isolate the narrative

    Narrative Detection groups the posts into the narratives driving the wave, so you examine one claim and the accounts behind it instead of a total mention count.

  3. Trace where it started

    Origin Point Mapping traces where a narrative started and how it spread. A spike that traces back to a single upstream post or community, with a call to action, is one of the strongest signs of brigading.

  4. Examine the accounts carrying it

    Key Authors & Amplifiers shows who is driving the narrative and their reach. Bot & Coordination Detection flags inauthentic amplification, coordinated behavior and bot networks. The behavioral signals analysts check are account age, posting rhythm, repeated text, shared links and who amplifies whom (see coordinated inauthentic behavior).

  5. Separate the real from the manufactured

    Authentic vs. Inauthentic analysis separates real human reaction from manufactured outrage. Most waves are mixed, so report both parts: how much of the volume came from flagged accounts and how much from independent ones. Volume and reach figures that include inauthentic accounts overstate real attention.

  6. Watch for the jump to mainstream coverage

    Influencer & Key Author Alerts fire when a high-reach voice such as a journalist enters the narrative. Threat Escalation Alerts notify the team when coordinated attacks, violent rhetoric or deepfake content targeting the brand are detected.

  7. Package the evidence

    Rapid Response Briefings produce an executive-ready situation brief with the context and recommended next steps. The same live view can be shared with legal and executive colleagues, and the PeakMetrics solutions team helps interpret the intelligence and draft the response.

  8. Act on it

    Narrative Takedowns issue takedowns and community notes against accounts that violate platform terms, from inside the platform. Brand Fact Centers publish branded fact-check pages that correct the record. If the wave is coordinated, engaging the fake voices as if they were real customers can lend them credibility; documenting and reporting the coordination is usually more useful.

What PeakMetrics provides

PeakMetrics is a narrative intelligence platform that shows communications, public affairs and risk teams how stories about their organization spread across news, social media and AI answers, and flags when those narratives are coordinated or manipulated.

The capabilities this workflow uses are listed below. Each is described in full on the platform page.

  • Bot & Coordination Detection

    Flags inauthentic amplification, coordinated behavior and bot networks.

  • Authentic vs. Inauthentic

    Separates real human reaction from manufactured outrage, so decisions rest on what real people think.

  • Origin Point Mapping

    Traces where a narrative started and how it is spreading.

  • Key Authors & Amplifiers

    Shows who is driving a narrative, including adversarial accounts, and how much reach they have.

  • Deepfake Detection

    Identifies AI-generated images, video and audio designed to deceive.

  • Narrative Velocity and Threat Escalation Alerts

    Notify the team when a narrative crosses your threshold or when coordinated attacks, violent rhetoric or deepfakes targeting the brand are detected.

  • Rapid Response Briefings

    Executive-ready situation briefs that combine the intelligence, the context and recommended next steps.

  • Narrative Takedowns

    Takedowns and community notes against accounts that violate platform terms, issued from the platform.

Limits

Frequently asked questions

What are the signs that negative posts about my company are coordinated?
Look for groups of accounts created close together, synchronized posting times, identical or lightly rewritten text, links to the same small set of domains, and dense amplification among a few accounts with little genuine interaction from outside the group. A sudden spike from accounts with no prior interaction with your company, tracing back to one upstream post, is a strong signal.
How do I tell whether negative coverage is bot-driven or organic?
Bot detection combines behavioral, network and content signals, such as posting frequency and hours, account age, repetitive text and whether accounts move in step with others, into a likelihood. Organic criticism tends to come from many independent accounts with varied histories. Because some campaigns use real people, check coordination and origin as well as bot scores.
How do I check whether a trending hashtag about my brand is being amplified by bots?
Look at who is posting the hashtag rather than how often it appears: how new the accounts are, whether their posting rhythm and text repeat, and whether a small cluster accounts for most of the volume. PeakMetrics flags inauthentic amplification and bot networks and shows the key accounts driving a narrative and their reach.
How do I prove to my CEO that a negative story was manufactured rather than real customer anger?
Show the evidence, not a conclusion: where the story started, which accounts carried it, and which posts and accounts PeakMetrics flagged as coordinated or inauthentic versus independent. Present it with its uncertainty. If part of the criticism is real, say so; a brief that separates the two is more credible than one that dismisses everything.
Can PeakMetrics prove who is behind a campaign?
PeakMetrics can show that accounts behaved in a coordinated or inauthentic way and trace where a narrative started. Naming the sponsor is a separate, harder step that usually needs evidence outside social data, such as disclosures, domain registrations or funding records. Responsible analysis keeps the two claims apart.
What should we do once we know a wave is coordinated?
Document the coordination and report accounts that violate platform terms; PeakMetrics can issue takedowns and community notes from the platform. Avoid engaging the fake voices as if they were a real constituency. Keep accurate information easy to find, and brief legal or security teams if the campaign involves impersonation, threats or deepfakes.

See this workflow on your own coverage.

PeakMetrics follows news and social media coverage, and what AI assistants say about your organization.

Book a Demo