What is coordinated inauthentic behaviour, and how do you detect it?

Coordinated inauthentic behaviour, defined

Coordinated inauthentic behaviour, often shortened to CIB, is activity by a group of accounts working together to mislead, while disguising the fact that they are coordinated or not genuine. It is the engine behind manufactured boycotts, bot-amplified rumours and influence operations, and it is the behavioural signature that Signal by AI Uniti is built to detect.

The important point is that CIB is defined by behaviour, not content. The individual posts in a coordinated campaign often look perfectly ordinary. What gives the campaign away is how the accounts behave together: the timing, the coordination and the structure of the network. That is also why content-based and keyword-based monitoring struggles with it, and why detection has to be behavioural. For the full definition and background, see what is coordinated inauthentic behaviour.

What are the signals?

CIB detection works by reading signals at three levels and combining them. No single signal is conclusive on its own; the pattern across all three is what reveals a coordinated operation.

Account level

The characteristics and history of an individual account: when it was created, how often and at what times it posts, how it has behaved over time, and whether its activity looks human or automated. A cluster of recently created accounts posting at machine-like intervals is a classic account-level indicator, and the same signals place an account on a bot-to-human spectrum rather than a simple yes-or-no label.

Network level

How accounts relate to one another. Coordinated networks share timing, content and amplification patterns that organic audiences do not produce. When dozens of accounts post the same narrative in synchronised bursts, or reliably amplify each other, the network structure itself is the evidence.

Campaign level

The same narrative correlated across multiple platforms, X, Bluesky, Mastodon, YouTube and RSS, inside the same window. Single-platform tools see only fragments. Correlating the campaign across channels is what exposes a deliberately distributed operation as a single coordinated effort.

How does detection score coordination?

Raw signals are not a verdict. Detection combines the account, network and campaign signals into a coordination score, and then resolves that into an explainable, deterministic verdict, a result that traces back to specific behavioural evidence rather than a black-box number.

That explainability is not a nicety. Risk, legal and compliance teams have to act on, and sometimes defend, these verdicts to a board, a regulator or a court, which they cannot do with an opaque score. Because attackers can change their words but not the coordinated way they behave, a behavioural verdict is also far harder to evade than keyword or sentiment monitoring. This is the same method behind the wider discipline of behavioural threat intelligence, and it is distinct from ordinary social listening.

Where should you start?

You do not need an enterprise rollout to test whether behavioural detection works. The fastest way to see it is to validate a single account or a suspicious cluster yourself.

PulseCheck by AI Uniti is the self-serve entry point. It scores individual accounts on a bot-to-human spectrum with an explainable verdict, so a risk, comms or security team can validate the capability on real accounts before committing to Signal for continuous, cross-platform monitoring. PulseCheck answers “is this account authentic?”; Signal answers “is this campaign coordinated, and who is behind it?”. You can also see how this plays out on real campaigns in our case studies, and how detection supports bot and impersonation use cases.

Frequently asked questions

What is coordinated inauthentic behaviour? Coordinated inauthentic behaviour is activity by a group of accounts working together to mislead, while disguising the fact that they are coordinated or not genuine. It is the behavioural signature that behavioural detection targets, and it is detectable even when individual posts look ordinary.

How do you detect coordinated inauthentic behaviour? By scoring behaviour at three levels: the account (age, history, posting cadence), the network (shared timing and amplification between accounts), and the campaign (the same narrative correlated across platforms in the same window). Together these signals separate manufactured consensus from organic activity.

Can I check a single account or campaign myself? Yes. PulseCheck by AI Uniti lets you validate individual accounts on a bot-to-human spectrum with an explainable verdict, so you can test the capability before an enterprise rollout of Signal.