|
10
A company can lose customers, see its stock drop, and spend months managing a crisis caused entirely by a story that spreads online.
That is a narrative threat.
A narrative threat is a claim or story propagated with the intent of changing belief, behavior, or perception, specifically one that is coordinated and engineered rather than organic. Adversaries build networks of inauthentic accounts to manufacture the appearance of consensus, then use that consensus to influence policy debates, procurement decisions, and election cycles.
Narrative threats often slip under the radar until they’re out in the open. Most security teams are built to stop cyber intrusions, but narrative threats are different because they can still cause harm without alerting SIEMs, EDR, vulnerability management, or threat intelligence platforms. Communications teams, meanwhile, are usually monitoring social media, which misses the underlying behavior that can help catch narrative threats early.
Read more about why brand monitoring doesn’t work to combat narrative threats here.
Organic Discourse vs. Narrative Threats
It’s important to distinguish between a narrative threat and the content of the narrative itself. For example, two social media accounts share a link to a negative news story about an organization. One was posted by a real person, while the other was from a fake account created two days ago. The narrative threat is not the news story itself, or whether the story is true. Rather, the narrative threat is the inauthentic nature of the latter post.
Beyond a single post, when there’s a network involved in manipulating online discourse via inauthentic means—such as automation, fake identity, manufactured engagement, or account manipulation—that constitutes coordinated inauthentic behavior. This can be extremely effective in impacting how the public thinks and feels at scale.
LetsData's framework groups narrative threat actors, including those behind coordinated inauthentic behavior, into four types.
State and state-aligned actors | Run operations as an instrument of national policy, often patient and well-resourced, building asset infrastructure years before activation |
Financially motivated actors | Treat narrative operations as a business, sometimes working as contractors for other clients, sometimes manipulating markets directly through fabricated claims |
Ideological and movement actors | Operate from conviction, achieving scale through a mix of genuine participation and inauthentic amplification |
Hybrid and proxy actors | A blend of all the above, with states contracting commercial operators and commercial operators amplifying ideological movements when interests align |
Narrative Threats in the Real World
Narrative threats don’t always look like bot networks spreading or amplifying stories. In March 2024, a known threat group called Mogilevich claimed on the Dark Web it breached gaming firm Epic Games. It was a lie, the group later admitted, meant to drive traffic to a fake website for ransomware services. In this case, the ultimate goal was not to influence public opinion, but to trick people into visiting a website.
In politics, narrative threats can influence public debate. During the height of the COVID-19 pandemic, for example, bad actors used coordinated inauthentic behavior to manipulate the conversation around vaccines, according to a 2023 peer-reviewed article published in Frontiers in Sociology.
“CIBs are a severe threat to unaware individuals interacting online, who might discuss public health policy issues with networked malicious agents, sharing pre-arranged content and disinformation rather than with genuine opponents, debating in a democratic scenario,” the article argues.
The common thread through these examples is not the content of the attack, but the engineering behind it.
A single inflammatory post from a real, unaffiliated account is just content. The same claim seeded across thirty newly created accounts within an hour, in three languages, with near-identical phrasing, is behavior. Behavior is observable, and it is the part an adversary cannot easily disguise, because running a coordinated operation requires producing artifacts that organic activity simply does not generate.
Organizations that can detect, attribute, and respond to this behavior can better combat narrative threats.