Reputational risk rarely arrives fully formed. It starts as a signal, gathers momentum as a narrative, and can escalate rapidly into a visible brand crisis. For Communications, PR, and Brand teams, the challenge is not simply detecting negative conversation. It is knowing what deserves attention, why it matters, and how urgently to respond.
That is why we have upgraded Crisis Oracle, to help you identify, measure, and prioritize brand threats with more precision. Instead of relying on an alert system that floods your inbox with undifferentiated incidents, you can now track the exact trajectory of a narrative across four distinct escalation stages informed by a multi-dimensional scoring model, from the first faint signal of a brewing story to a fully entrenched crisis.
This latest update addresses the most critical feedback we've heard from users. The previous alert system helped teams identify potential risks, but it did not always make prioritization easy. Alerts could lack clear severity, clusters were labelled generically, key metrics were buried in the body of the email, and users often had limited evidence to understand the tone or spread of a narrative.
The new Crisis Oracle addresses that directly.
What we heard from you
Across hundreds of alerts, the same patterns kept surfacing:
Key metrics; velocity, reach, participation size, were not visible at the top of the alert.
Clusters had no descriptive title; they were labelled “Story 0”, “Story 1”, and so on.
Only one sample post was shown per narrative, making it impossible to read the true tone.
The Pulse Score was expressed as an angle (0–180°), which was counterintuitive for non-technical users.
“Why is this Risky” was a fixed boilerplate section that added noise rather than insight.
Cluster size was not shown as a proportion of the total conversation.
What we have addressed
THREAT STAGES 4 | SCORING DIMENSIONS 3 | CLUSTERS VALIDATED 451 | BRANDS TESTED 6 |
1. A New Four-Stage Threat Classification Framework
Crisis Oracle now evaluates every threat cluster across three independently scored dimensions and assigns it to one of four named escalation stages. Instead of one undifferentiated bucket, you'll see exactly where a threat sits on the escalation path, and what action is recommended. This gives teams a shared language for triage and response, from the first faint signs of a brewing story to a fully developed reputational event.
Stage | Label | What it means |
Stage 1 | Signal | Early, low-level activity. A narrative has been detected but has not yet gained traction. Monitor for changes. |
Stage 2 | Narrative | The narrative is gaining traction. Multiple sources are contributing and the story is beginning to cohere. |
Stage 3 | Escalation | The threat is building significant momentum and reach. Analyst review and brand-team awareness are recommended. |
Stage 4 | Crisis | A full-blown, highly visible, and rapidly spreading crisis. Activate your crisis response playbook immediately. |
2. Three New Scoring Dimensions
Every alert is now scored on Spread (how many people are pushing the narrative), Intensity (how aggressively it is changing), and Amplification (how far it is reaching). This multi-dimensional approach also enables us to flag asymmetric risks; clusters where a small number of highly coordinated actors are generating disproportionate activity, so your team can monitor them closely before they break through.
Each dimension answers a distinct question about the nature of the threat:
Dimension | Question | Metrics | Benefit |
Spread | How many are talking? | Authors, Cluster Size | Distinguishes lone actors from coordinated groups. |
Intensity | How aggressively is it moving? | Velocity, Pulse Score | Identifies momentum before it becomes visible. |
Amplification | How far is it reaching? | Impressions, Visibility | Measures real-world exposure beyond raw post counts. |
What this means in practice
Together, these dimensions provide a more complete view of risk. Instead of collapsing every signal into a single score, Crisis Oracle now helps teams understand not only how serious a threat is, but what kind of threat it is.
| Stage 4: Crisis
Classification rule: Spread ≥ HIGH and Intensity ≥ HIGH and Amplification ≥ HIGH A crisis that is fully embedded in the public conversation. All three dimensions are operating at high intensity simultaneously. The cluster dominates its topic space, is generating high post velocity with strongly hostile sentiment, and is reaching a large audience. Immediate brand team involvement is warranted. |
| Stage 3: Escalation
Classification rule: Intensity ≥ MEDIUM and Amplification ≥ MEDIUM A narrative that is actively escalating. The conversation is energetic and reaching an audience, but may not yet involve a broad coalition of participants. Requires brand team review. Response preparation should begin. Under the old system, 65 such clusters were mislabelled INCIDENT. |
| Stage 2: Narrative
Classification rule: Spread ≥ MEDIUM, or both Spread AND Intensity ≥ LOW-MEDIUM A growing cluster where multiple voices are beginning to align around a narrative. It has not yet crossed escalation thresholds on Intensity or Amplification. Analyst review is recommended. 44 clusters previously labelled CRISIS are correctly downgraded to this stage. |
| Stage 1: Signal
Classification rule: Default; no higher stage thresholds met An early signal that does not yet meet escalation criteria on any dimension. It may be a single author, a low-volume discussion, or a transient spike. These are surfaced for monitoring but do not require active response. They represent 45.5% of all clusters in validation data. |
3. New Asymmetric Risk Detection
A new protective mechanism flags threats where one dimension is dramatically higher than the others. A small, coordinated group can generate disproportionate momentum before a wider audience notices. Rather than over-staging these as a full Escalation, the system caps the stage and raises an Asymmetric Risk flag so analysts know to watch closely without over-responding. Consequently, teams can now spot organized activity early without overstating every spike as a full crisis.
4. Redesigned Alert Email Format
The alert email has been completely restructured to surface the most important information immediately, in a consistent, scannable layout.
Before | After |
“Story 0”, “Story 1” offered no context | Human-readable cluster title in 5–10 words |
Metrics buried in the body of the email | Spread, Intensity and Amplification displayed at the top as clear metric blocks |
Cluster size not shown | Cluster size shown as % of total conversation volume in the last hour |
Pulse Score in degrees (0–180°) | Hostile Momentum on an intuitive 0–100 scale |
1 sample post per narrative | Up to 5 sample posts, prioritizing high-visibility content across a mix of channels (not just X). |
“Why is this Risky” boilerplate section | Boilerplate removed; narrative story section takes its place |
5. Increased post-sample volume with pagination
The system now retrieves more posts per hour by applying pagination logic and sorting by relevance and visibility. This gives analysts richer evidence to make faster judgement calls without leaving the alert email.
Summary of Key Benefits
The following table summarizes the key benefits delivered by this update:
Change | Problem it solves | Benefit |
Four-stage threat classification | All alerts had no granularity; undifferentiated and un-actionable. | Clear escalation 4 stage path from emerging signal to entrenched crisis. Analysts can immediately see where a threat sits and prioritize accordingly. |
Three scoring dimensions (Spread, Intensity, Amplification) | A single aggregate score masked the reason a threat was dangerous, so threats with mismatched characteristics were mislabelled. | A multi-dimensional view; each dimension answers a different question. Analysts understand not just severity, but nature. |
Asymmetric Risk flag | Coordinated campaigns with few authors but extreme activity were either under-staged or over-staged. | Accurate detection of organised advocacy, with a clear monitoring signal rather than a false crisis alert. |
Auto-generated cluster title | Clusters were labelled “Story 0”, “Story 1” etc., conveying no information. | Analysts can skim an inbox of alerts and understand each one at a glance. |
Key metrics at the top of the alert | Velocity, reach, and participation data were buried mid-email. | The most important triage information appears before the analyst reads any narrative copy. |
Cluster size as % of total volume | There was no way to tell whether a cluster dominated conversation or was a fringe noise signal. | Analysts instantly see relative scale, distinguishing 60% of conversation from 2%. |
Hostile Momentum (0–180 scale) | The Pulse Score was expressed as an angle in degrees, which was not intuitive for non-technical users. | A clear, consistently labelled scale from 0-100 makes momentum readable for all audiences. |
5 sample posts (high-visibility, mixed-channel) | One X post was insufficient to convey tone, breadth, or channel distribution. | Up to five posts from a mix of platforms give a genuine sample of the conversation. |
Pagination for post retrieval | The system retrieved too few posts per hour, limiting the quality of the sample. | More comprehensive hourly samples improve clustering accuracy and narrative representation. |
Availability
The new Crisis Oracle methodology has been validated against 451 clusters across six brands and is now available for all current clients with access to the agent. No action is required on your side; the next alert you receive will use the new format.
If you'd like a walk-through with your account team, or want to share feedback on the new logic, we'd love to hear from you.