The 2026 FIFA World Cup begins on 11 June, four days from now. By kickoff, the largest behavioural attack surface ever generated by a single sporting event will be fully live: 48 teams, 104 matches, 16 host cities across the United States, Mexico and Canada, and a projected global audience above five billion viewers.
Our monitoring stack for it has been live since February.
This was not an accident of scheduling. Anything less than four months of lead time would have left us reacting to coordinated attacks instead of detecting them before they spread. This is what setting up months ahead actually looks like, and why we built the agentic AI layer of Unite to make it possible.
Why the World Cup is different
The Monaco GP and other events we have monitored share a common shape: high attention, a concentrated time window, identifiable targets. The World Cup is the same shape multiplied by an order of magnitude in every dimension.
- 48 teams instead of 20 drivers, each with its own fanbase, internal politics, and exposure surface.
- 104 matches over 39 days instead of one weekend. The cycle does not reset between events. Controversies compound.
- 16 host cities across three countries, each with its own political and social context layered on top of the football.
- More than 30 languages that matter for global narrative monitoring. Not just English, but Spanish, Portuguese, Arabic, French, German, Italian, Korean, Japanese and others.
- Hundreds of sponsors at the global, regional and national-team level. Each one is a potential narrative attack target.
- Six weeks of saturation media coverage, meaning every controversy compounds rather than resolves.
A coordinated network targeting a single match-day moment could go undetected for hours in this environment, even by an attentive monitoring team. The volume is the camouflage. We needed an architecture that did not depend on humans noticing.
What setting up months ahead actually involves
The setup work we have been doing since February covers four layers.
Surface enumeration. Mapping the accounts, hashtags, brand handles, player handles, sponsor handles, referee handles, federation handles, broadcast partner handles, and regional fan ecosystems across X, Bluesky, Mastodon, Instagram, Facebook, Reddit, YouTube and TikTok. Approximately 4,200 accounts across 12 languages, with ongoing additions as squad announcements firm up.
Behavioural baselining. Establishing what normal coordinated activity looks like in each of these surfaces. Fan group chats. Hashtag spikes around scheduled events. Bot networks that opportunistically attach to football traffic but are not specifically activated against the Cup. The detection layer needs to know what background noise looks like before it can flag the foreground signal.
Narrative cluster preparation. Pre-building narrative classifiers for the categories we know from prior tournaments will be active: refereeing disputes, doping accusations, host-country politics, sponsor activism, fan violence, racism and abuse cycles, ticket fraud, and broadcast-rights disinformation. Each cluster ingests baseline content during the lead-up so that the moment a coordinated wave begins, the system already has a fitted model for what to flag.
Sponsor mapping. Coordinating directly with the brand stakeholders we work with. Their threat surface includes their brand handles, their athlete endorsement portfolios, their activation campaigns and their executive teams. All of those need to be in the monitoring graph before the tournament starts. Adding them at the moment of a live attack is already too late.
What the agentic AI layer actually does
The agentic layer sits between detection and human attention. Three things make it different from the rule-based alerting that most monitoring platforms ship with.
Triage with context. When a coordination signal fires, an agent assembles the full evidence package before any human sees it. The accounts, the network topology, the timeline, the parallel narratives, the related historical events. A human analyst opening an alert at 3am does not have to do the spadework. The work is done.
Cross-platform correlation. Most monitoring platforms operate per-channel. The agentic layer treats every platform as part of one behavioural graph. When a cluster of accounts active on Reddit on Tuesday morning shows behavioural overlap with a cluster amplifying on X on Tuesday evening, that connection surfaces as a single alert rather than two unrelated incidents.
Autonomous escalation. Most signals do not need human attention. The agents resolve, dismiss or watch them quietly. The signals that do need attention reach a human inside the relevant window, with appropriate severity, with the right people on the distribution list. False positive fatigue is the failure mode that kills every monitoring programme over time. Agentic triage is how we hold the line on it.
Where Unite ties it together
Unite is the operating layer where everything converges.
For routine activity, Unite runs the lights. Agents triage, score and queue. Reports generate themselves on the cadence each stakeholder wants. Distribution lists, severity thresholds, escalation paths and playbook templates all live here.
For incidents, Unite is the response substrate. When a signal crosses the threshold from "monitor" to "act", Unite is what activates the response. Pre-drafted briefings populate with the live evidence. Stakeholder Slack channels and email lists receive the alert with the relevant context attached. If a sponsor needs to make a same-hour decision about pausing an activation, the briefing is ready before they have finished asking for it.
For learning, Unite is the institutional memory. Every incident across every event flows back into the behavioural baselines for the next one. The 2026 World Cup will sharpen our detection for the Australian Open in 2027, which will sharpen our detection for the next Rugby World Cup, which will sharpen our detection for the World Cup after that.
Why we are sharing this now
Two reasons.
One: the brands and federations working with us on this already know how it works. Everyone else is welcome to see what an actually-prepared monitoring operation looks like before an event, not after. The "we should have started earlier" conversation is the most common conversation that happens after a major incident. We would prefer organisations not have it.
Two: the most consequential thing we have built this year is not a detection algorithm or a new platform feature. It is the agentic intelligence layer that lets a small team monitor a planet-scale attack surface without falling behind it. The World Cup is the proving ground. The applications go well beyond sport.
If your organisation has commercial exposure to the 2026 World Cup, or to any high-stakes public moment in the next twelve months, the right time to start setting up was last quarter. The next-best time is now.
June 7, 2026