What Is Coordinated Inauthentic Behaviour (CIB)?
In short. Coordinated inauthentic behaviour is organised networks of disguised accounts manipulating public conversation through deceptive synchronised activity rather than authentic engagement.
What Is Coordinated Inauthentic Behaviour (CIB)?
Coordinated inauthentic behaviour (CIB) is the organised use of multiple accounts, often disguised as independent individuals, to manipulate public conversation through deceptive coordination rather than genuine engagement. The accounts work together to a shared purpose while hiding that they are connected and not authentic. The defining feature is not what the accounts say. It is how they behave: synchronised, organised, and concealed.
How Coordinated Inauthentic Behaviour Works
CIB campaigns are built on coordination that real audiences do not exhibit. A genuine conversation grows unevenly. People join at different times, from different places, with different phrasing and different reasons. A coordinated campaign does the opposite. Typical mechanics include synchronised timing, where many accounts post or amplify within tight windows; shared assets, where accounts reuse images, links or phrasing from a central source; account clustering, with profiles created in batches; an amplification structure, where a small core seeds content while a larger ring amplifies it; and cross-platform spread, where the same narrative appears across X, Bluesky, Mastodon, YouTube and RSS in a pattern too clean to be coincidence. The goal is to make a manufactured position look like a popular one.
CIB Versus Organic Activity
The hard problem is that coordinated and organic activity can look identical on the surface. The difference is in the behaviour underneath. Organic activity is messy: timing is irregular, accounts have varied histories, and amplification rises and falls naturally. Coordinated activity is structured, and the structure shows up in temporal patterns, account relationships, and amplification mechanics that betray central direction. This is why content alone is unreliable for detection. The manipulation lives in the coordination, not the claim.
How CIB Is Detected Behaviourally
Behavioural detection identifies coordination through how accounts act, not what they post. This approach is language-agnostic and resistant to the evasion tactics that defeat content-based monitoring. PulseCheck scores individual accounts on a bot-to-human spectrum using temporal and behavioural signals, returning deterministic and explainable verdicts. Signal by AI Uniti extends this to the network level, correlating behaviour across platforms to surface coordinated campaigns, with each verdict supported by a traceable evidence chain. Because the method targets behaviour, it holds up when bad actors translate their content, rotate their phrasing, or switch topics.
Why CIB Matters to Enterprises
For enterprises, coordinated inauthentic behaviour is a financial and reputational risk, not a moderation footnote. The 2013 Associated Press Twitter hack wiped roughly US$136 billion off the S&P 500 in about three minutes on a single false post. The Silicon Valley Bank collapse in 2023 saw roughly US$42 billion in withdrawals in 24 hours. The Adani and Hindenburg episode in 2023 erased more than US$100 billion over eight weeks. Narratives travel faster than verification, and coordinated amplification turns a spark into a fire. AI Uniti’s 6 to 12 hour early warning window exists precisely to give enterprises time to respond.
Frequently Asked Questions
What is the difference between coordinated inauthentic behaviour and a bot network?
A bot network is one method used to carry out CIB. Coordinated inauthentic behaviour is the broader category of organised deception, which can involve bots, paid human operators, or a mix of both. The unifying factor is concealed coordination.
Can coordinated inauthentic behaviour be detected without reading the content?
Yes. Behavioural detection identifies CIB through timing, account relationships, and amplification structure. Because these signals are language-agnostic, the method works even when the content is benign, translated, or constantly rephrased.
Is all coordinated activity inauthentic?
No. Coordinated activity becomes inauthentic when it is deceptive, for example when accounts hide that they are connected or pretend to be independent individuals. Openly organised campaigns are coordinated but not inauthentic.
How quickly can CIB affect a company?
Very quickly. Documented incidents have moved markets in minutes. Signal by AI Uniti provides a 6 to 12 hour detection window ahead of conventional monitoring, which is often the difference between an early response and a full-blown crisis.