What Is Coordinated Inauthentic Behaviour (CIB)?
Coordinated inauthentic behaviour (CIB) is the organised use of multiple accounts, often disguised as independent individuals, to manipulate public conversation through deceptive coordination rather than genuine engagement. The accounts work together to a shared purpose while hiding that they are connected and not authentic.The term was popularised by platform integrity teams to describe networks that break the rules of authentic participation. The defining feature is not what the accounts say. It is how they behave: synchronised, organised, and concealed.
How Coordinated Inauthentic Behaviour Works
CIB campaigns are built on coordination that real audiences do not exhibit. A genuine conversation grows unevenly. People join at different times, from different places, with different phrasing and different reasons. A coordinated campaign does the opposite.
Typical mechanics include:
Synchronised timing: Many accounts post, reply, or amplify within tight windows that no organic crowd would naturally produce
Shared assets: Accounts reuse images, links, phrasing, or hashtags pushed from a central source.
Account clustering: Profiles created in batches, with similar metadata, follower patterns, or activity rhythms.
Amplification structure: A small core of accounts seeds content while a larger ring amplifies it to manufacture the appearance of consensus.
Cross-platform spread: The same narrative appears across X, Bluesky, Mastodon, YouTube, and syndicated RSS feeds in a pattern too clean to be coincidence.
The goal is to make a manufactured position look like a popular one. When enough fake voices repeat a claim, real people start to believe it reflects genuine sentiment.
CIB Versus Organic Activity
The hard problem is that coordinated and organic activity can look identical on the surface. A trending topic and an astroturfed one both produce a spike in posts. The difference is in the behaviour underneath.Organic activity is messy. Timing is irregular, accounts have long and varied histories, and amplification is driven by genuine interest that rises and falls naturally. Coordinated activity is structured. The structure shows up in temporal patterns, account relationships, and amplification mechanics that betray central direction.This is why content alone is unreliable for detection. The words in a coordinated post may be perfectly reasonable, factually defensible, and indistinguishable from a real opinion. The manipulation lives in the coordination, not the claim.
How CIB Is Detected Behaviourally
Behavioural detection identifies coordination through how accounts act, not what they post. This approach is language-agnostic and resistant to the evasion tactics that defeat content-based monitoring.
AI Uniti's architecture is built on this principle. PulseCheck scores individual accounts on a bot-to-human spectrum using temporal and behavioural signals, returning deterministic and explainable verdicts rather than black-box guesses. Signal by AI Uniti extends this to the network level, correlating behaviour across platforms to surface coordinated campaigns.
Behavioural detection looks for:
Temporal anomalies.Posting rhythms and synchronisation that organic crowds do not produce.
Account-level signals. Creation patterns, activity cadence, and relationship structures that indicate clustering.
Cross-platform correlation. The same coordinated pattern appearing simultaneously across multiple platforms, which is the core of Signal's architecture.
Evidence chains. Each verdict is supported by traceable signals, so an analyst can see why a network was flagged.
Because the method targets behaviour, it holds up when bad actors translate their content, rotate their phrasing, or switch topics. The coordination remains visible even when the words change.
Why CIB Matters to Enterprises
For enterprises, coordinated inauthentic behaviour is a financial and reputational risk, not a moderation footnote. A manufactured narrative can move markets and damage brands before any human team recognises what is happening.
The historical record is clear. The 2013 Associated Press Twitter hack wiped roughly US$136 billion off the S&P 500 in about three minutes on a single false post. The Silicon Valley Bank collapse in 2023 saw roughly US$42 billion in withdrawals in 24 hours as panic spread online. The Adani and Hindenburg episode in 2023 erased more than US$100 billion over eight weeks. Eli Lilly lost roughly US$15 billion in market value in 2022 after a single inauthentic account impersonated the brand.
These are not all classic CIB cases, but they show the same underlying truth: narratives travel faster than verification, and coordinated amplification turns a spark into a fire. AI Uniti's 6 to 12 hour early warning window exists precisely to give enterprises time to respond before a coordinated narrative reaches conventional monitoring.
Frequently Asked Questions
What is the difference between coordinated inauthentic behaviour and a bot network?
A bot network is one method used to carry out CIB. Coordinated inauthentic behaviour is the broader category of organised deception, which can involve bots, paid human operators, or a mix of both. The unifying factor is concealed coordination.
Can coordinated inauthentic behaviour be detected without reading the content?
Yes. Behavioural detection identifies CIB through timing, account relationships, and amplification structure. Because these signals are language-agnostic, the method works even when the content is benign, translated, or constantly rephrased.
Is all coordinated activity inauthentic?
No. Coordinated activity becomes inauthentic when it is deceptive, for example when accounts hide that they are connected or pretend to be independent individuals. Openly organised campaigns, such as a transparent advocacy push, are coordinated but not inauthentic.
How quickly can CIB affect a company?
Very quickly. Documented incidents have moved markets in minutes. Signal by AI Uniti provides a 6 to 12 hour detection window ahead of conventional monitoring, which is often the difference between an early response and a full-blown crisis.
---
For more behavioural threat intelligence definitions, see the Narrative Threat Glossary.
Book a 15-minute Signal by AI Uniti demo at aiuniti.com/signal.
June 18, 2026