In late 2024, a regional consumer brand selling packaged foods in the Mountain West suddenly found itself at the center of a social media storm. Dozens of accounts across two platforms posted near-identical complaints within a four-hour window — same product angle, almost verbatim phrasing, accounts ranging from a few weeks to a few months old. By the time their PR team noticed, local news had already picked up the story.
The complaints may or may not have been fabricated. What we do know is that the pattern bore zero resemblance to organic negative sentiment. Real customer complaints don't arrive in tight timing clusters. They don't share phrasing across accounts with no social history. They don't originate from accounts created within the same two-week window.
Detecting coordinated inauthentic behavior (CIB) targeting a brand is a distinct problem from detecting organic sentiment shifts — and the two require completely different analytical approaches.
Why Coordination Is Hard to Surface Without Dedicated Detection
Standard sentiment monitoring tools are built to answer the question: "What are people saying about us?" They aggregate mentions, classify polarity, and track volume trends. That's useful for organic reputation management, but it handles CIB poorly for a structural reason: it counts volume without questioning the authenticity of the accounts generating it.
A well-executed coordination campaign produces signals that look alarming in a volume-based dashboard but whose individual components look innocuous. Each post, taken alone, reads like a legitimate complaint. No individual post is obviously fake. The attack surface is the coordinated pattern — the timing, the structural similarity across messages, and the demographic impossibility of real accounts behaving this way.
This is the detection gap we've been working to close. Our approach treats coordination as a graph and timing problem, not just a content problem.
The Three Signals We Weight Most Heavily
Timing Clusters
Organic negative sentiment has a natural temporal distribution. Even during a genuine product controversy — a labeling error discovered by one food blogger, for example — the spread follows a recognizable diffusion curve. Initial posts cluster around the original source, then secondary amplification comes hours or days later as the story picks up reach.
Coordinated campaigns tend to break this pattern. Posts arrive in tight synchrony across accounts that have no apparent social connections to each other. We look at the inter-arrival time distribution across a mention set: are posts arriving in a pattern consistent with independent discovery, or does the distribution have sharp peaks suggesting a trigger event that activated multiple accounts simultaneously?
No single timing anomaly is conclusive. But when the inter-arrival pattern is 3+ standard deviations from what we'd expect for organic spread in that content category, it becomes a weighted input into the overall coordination score.
Phrasing Similarity Across Uncorrelated Accounts
The second signal is linguistic. We use cosine similarity on n-gram embeddings to measure how closely posts targeting a brand resemble each other — and more importantly, to identify whether that similarity is higher than what you'd expect given the accounts' prior interactions.
If two accounts that have never interacted, follow none of the same people, and were created in different months are using near-identical phrasing to describe a product complaint, that's a flag. The threshold isn't exact match — experienced operations will paraphrase. But the structural similarity often persists: same compound phrase, same claim structure, same call to action at the end.
We're not trying to prove a human intentionally copied a talking point. We're surfacing the statistical improbability that independent accounts would converge on this specific framing by coincidence.
Account Age and Activity Distribution
The third signal is account-level. Inauthentic accounts created for a coordinated campaign often share demographic characteristics: created within a short window relative to the campaign, low prior activity volume, limited interaction history, follower counts inconsistent with stated engagement history.
We look at the distribution of account ages across a coordinated mention set. If 60% of the accounts posting a specific brand narrative were created within the same six-week window, that's a structurally improbable distribution for organic sentiment.
This signal is noisier on platforms that don't expose account creation dates. But even proxies — post history depth, follower-to-following ratios, account avatar patterns — can contribute to a probabilistic account authenticity score.
How We Score Coordination Probability
None of these signals is individually sufficient to classify a mention set as coordinated. Our model outputs a coordination probability score — not a binary classification — that combines all three weighted inputs with a few secondary features (platform-specific behavioral norms, network overlap between flagged accounts, and velocity relative to baseline for that brand).
A score above 0.7 generates an alert classified as "suspected coordination" in the Brandpathio dashboard. Above 0.85, the alert escalates to "high-confidence coordination pattern." Below 0.5, the mention set is logged but not alerted on — it may be organic negative sentiment that simply shares topical similarity.
We're deliberately conservative with the high-confidence threshold. We'd rather surface a genuine CIB event at 0.75 and let your team investigate than have you dismiss alerts because the system cried wolf too often.
What We're Not Claiming This Detects
It's worth being explicit about the limits. Our detection model surfaces statistical patterns consistent with coordination. It does not identify who is behind the campaign, whether it's competitor-driven, a disgruntled former employee operation, or an external political actor. That attribution layer is beyond what signal analysis alone can provide.
We're also not building a disinformation detection system in the full sense — that would require tracking claim veracity across sources, which is a different (and much harder) problem. What we surface is coordination patterns, not truth claims. A coordinated campaign might be spreading accurate information through inauthentic means. Our alert tells you the pattern is suspicious; it doesn't tell you whether the content is false.
For the packaged food brand mentioned above: our system surfaced the coordination pattern within 2 hours of the campaign starting. The communications team was able to brief their CEO before local news made contact, and they led with a proactive statement that framed the pattern as suspicious rather than reacting defensively to the complaint volume. Whether or not the original complaints had any factual basis, they controlled the narrative context.
Where Detection Meets Response
The operational question we hear most often is: "What do we do when we get one of these alerts?"
The honest answer is: it depends on what your legal and communications teams have agreed in advance. Some brands choose to flag suspicious patterns to the platform directly. Others issue a preemptive statement noting that anomalous activity has been detected. Some use the alert primarily to brief internal stakeholders so they're not caught off guard by escalating coverage.
What we can tell you is that response options narrow significantly after a campaign goes mainstream. If local or trade media has already picked it up as a genuine controversy, the coordination angle becomes harder to communicate without looking defensive. The window where "we identified a suspicious pattern" is a viable response strategy is typically 2–6 hours from detection — which is why the alert timing matters as much as the alert content.
We built the coordination detection layer because we kept seeing communications teams discover these campaigns from journalists calling for comment, not from their own monitoring. That's a solvable problem if the signal is surfaced early enough. It's almost never solvable by the time the call comes in.