EDELMAN  ×  OSAVUL

Counter-Disinformation Unit

Reputational Threats on Hard-to-Monitor Platforms:

The Enterprise Risk Reality

Analysis period: June 1 – December 1, 2025  |  130 global brands across TikTok and Telegram

~3.37 billion estimated views where reach data was available

Executive Summary

An Edelman analysis in partnership with Osavul

Reputational threats on hard-to-monitor platforms — primarily TikTok and Telegram — are now tightly bound to legal, operational, and physical risk. They can create real liability, trigger safety concerns, and cause operational disruption. In some cases, they serve as precursors to cyber or real-world harm, on top of the reputational damage most organisations are already trying to manage. Many organisations remain blind to these threats until it is too late.

This report, produced jointly by Osavul and Edelman's Counter-Disinformation Unit, analyses six months of threat data across 130 global brands. Of those brands, 76 were subjects of adverse reputational narratives. In total, 1,271 distinct narratives were detected, comprising at least 25,053 messages and generating approximately 3.37 billion views where reach data was available.

The findings reveal a corporate threat surface that is broader, faster-moving, and more closely linked to enterprise risk than most organisations are currently structured to manage. The solution is organisational: integrate communications, legal, intelligence, and security around shared detection processes, response playbooks, and measurable escalation thresholds.

This is a warning about adversarial storytelling that exploits moments of reputational vulnerability, regulatory exposure, social tension, and operational disruption — shaping perception faster than organisations can identify the threat, validate the facts, align internally, and respond with credibility.

The data points to a shift in kind, not just in volume. Reputational threats are aligning with enterprise risk in ways that challenge existing governance, escalation, and ownership models.

Methodology

The underlying data collection and threat intelligence analysis were conducted by Osavul, an AI company specialising in strategic intelligence and countering hybrid threats. Osavul used its AI platform, Nebula, to carry out a three-step analytical process:

• Collection of precise data from hard-to-monitor networks using Osavul's proprietary data pipeline technology.

• Extraction of stable and evolving narratives from the dataset through Osavul's AI-powered narrative intelligence technology.

• Identification of threats within narratives exhibiting indicators of malicious activity, using Osavul's threat intelligence capabilities.

Osavul's threat-intelligence dataset, reviewed by Edelman's Counter-Disinformation Unit, covers six months of TikTok and Telegram content relating to 130 global brands and sectors between 1 June and 1 December 2025. Of those, 76 were the subjects of adverse reputational narratives.

Each threat was categorised across multiple dimensions: target type (company, product or service, leadership, industry); threat type (legal or regulatory, physical, technical, reputational, among others); subtype themes; platform dynamics; language; and geographic indicators. Some individual threats spanned multiple categories, but the dominant patterns were consistent.

Classification

Each identified threat was classified across broad type, subtype, description of the threat behaviour, and observable objective characteristics. One threat can have several individual threat types — for example, a threat can be both legal/regulatory and technical at the same time.

Number of Individual Threats by Type

The threat types can be separated by the categories. Each individual category has its own count in the report. One threat can have several individual threat types. For example, the threat can be both legal/regulatory and technical at the same time.

The number of the individual threat types is the following: legal/regulatory individual threats totals 909, physical threats 713, reputational threats 239, technical 145, global threats 38, operational 35, financial 27, health and safety 13.

This puts legal/regulatory threats in the top of the number of individual threat types together with physical threats. These threat types can come together with other threat types or come solely.

Industry Analysis

The 1,271 threats were distributed across 42 industries. The Technology sector was by far the most targeted, generating 8,024 threat messages — more than double the volume of the next closest sector. E-commerce and Cloud Computing followed with 2,903 messages. Defense and Aerospace & Defense featured prominently, with 2,330 and 1,740 messages respectively, reflecting sustained threat activity against critical infrastructure.

Legal and Physical Narratives Dominate the Threat Landscape

Legal and compliance threats were the most common form of adverse narrative, appearing in nearly three out of four cases (71%). Physical-world risks — including civil unrest and criminal activity — featured in more than half of all cases (56%).

These narratives gain their potency from plausibility. They are built on storylines that are hard to quickly disprove and capable of triggering real-world consequences: regulatory investigations, litigation, protests, and safety incidents. Looking at specific allegation types, compliance violations were the most frequently occurring at 532 instances, followed by political or civil unrest (501), regulatory investigations (404), criminal activity (361), and lawsuits (306).

Threat Subtypes by Occurrences

Message Volume by Threat Type Combination

The 1,271 narratives produced 25,053 messages in total. Threats focused purely on legal and regulatory matters generated the highest single-category volume at 5,775 messages. The next four most common types each combined multiple high-impact areas, underscoring how threat actors layer risks to maximise pressure.

This picture points to a threat environment increasingly grounded in real-world consequences — legal action, government fines, operational disruption, and safety incidents — rather than purely image-based attacks.

The Grey Zone

This pattern challenges a common organisational assumption: that defending against adverse narratives is mainly about debunking outright lies. The modern threat environment is far murkier. Organisations today face a mix of selectively true claims, exaggerated accusations, videos or quotes stripped of context, and the deliberate amplification of unresolved issues. None of these tactics require a single demonstrably false statement to keep an organisation permanently on the defensive.

Target Analysis

The threat landscape is overwhelmingly focused on two primary targets: the organisation as a whole and its product offerings — not individual executives.

Adversarial narratives focus on the institution in 1,196 instances, linked to 23,619 messages and approximately 3.33 billion views. Narratives targeting products and services span 876 instances, linked to 17,342 messages and approximately 2.03 billion views, with some narratives spanning both categories.

These narratives travel so effectively because they make abstract reputational themes feel tangible. They align with real-world anxieties and force organisations into responding to complex issues across functional boundaries — questions of safety, ethics, legality, and trustworthiness.

Narratives focused on leadership and executives appear less frequently than those focused on companies or products — but when they do occur, their impact is significant. The dataset includes 142 narratives targeting individual leaders, generating 3,040 messages and approximately 787 million views.

Leadership narratives compress complex organisational issues into simple storylines that are easier to personalise, weaponise, and mobilise around. They travel efficiently in short-form video formats and can escalate quickly into harassment, intimidation, and physical security risks.

Geographic & Language Analysis

Threat amplification occurs across multiple languages, led by English, Italian, and Russian, followed by German, Spanish, Portuguese, Ukrainian, Romanian, and French. Narratives can move across platforms, borders, and languages before appearing in mainstream channels — while it remains hard to identify, attribute, and track specific threat actors.

Message Volume by Language

Threat Longevity

Most threats burn out quickly. The median lifespan is just 2 days, with three-quarters of all threats fading within 3 days. Nine out of ten are gone within four days. Cases that stretch beyond a week — the longest running lasted 77 days — are rare outliers. The distribution is overwhelmingly concentrated in the first few days.

This has a direct implication for how organisations respond. By the time a threat has been escalated internally, reviewed by communications and legal teams, and a response has been drafted, the moment may already have passed. Organisations that lack pre-approved response frameworks, ready-made holding statements, and clear escalation protocols are effectively arriving late to every incident. Speed is not just an advantage — in most cases, it is the deciding factor.

Threat activity is not evenly distributed across the corporate landscape. It concentrates around organisations that combine high public visibility with exposure to politically or socially sensitive issues.

In the dataset, the five most-targeted brands account for more than half (59%) of detected threats. These organisations are typically large, well-known companies operating in sectors that attract regulatory scrutiny, geopolitical attention, or public controversy. Global technology platforms, infrastructure providers, and companies in strategically sensitive industries feature prominently.

This concentration reflects how adversarial actors allocate attention and resources. They focus where narratives are most likely to resonate with existing public debate, spread quickly across platforms, and exert pressure on companies through stakeholders, regulators, or political actors.

Recommendations

If reputational threats are converging with enterprise risk, organisations' responses must mirror this. Fragmented ownership slows response and compounds the problem.

1. Create a cross-functional narrative response cell

High-performing organisations align communications, intelligence, legal, and security teams around a shared view of the threat landscape. Siloed decision-making is the single greatest enabler of slow response.

2. Map narrative exposure like a risk register

Recurring themes — compliance, investigations, unrest, criminality, and cyber activity — should be treated as predictable attack vectors, not surprises. Organisations can often pre-bunk these narrative attacks by communicating counter-arguments to their key audiences in advance.

3. Invest in advanced monitoring and detection

Standard social media monitoring cannot effectively track content on TikTok, Telegram, or similar platforms. You need to see it to analyse it. Adversarial content can go viral quickly, and organisations need to know what they can safely ignore versus where they need to intervene early.

4. Develop and test platform-appropriate playbooks and content

The reach and speed of hard-to-monitor platforms demand rapid, credible, and appropriate responses. Organisations should simulate adverse narratives appearing on these platforms and spreading to mainstream channels to stress-test their plans before an incident occurs. Rapidly deployable digital assets should be prepared in advance.

5. Establish rapid decision-making procedures

Narrative attacks move quickly, but organisational decision-making often does not. Companies should predefine escalation triggers, decision authority, and response ownership across communications, legal, and security teams. When these pathways are clear in advance, organisations can respond faster and with greater confidence.

Conclusion

The appearance of adverse narratives on hard-to-monitor platforms is not a niche concern. It acts as an accelerant, attaching itself to issues around legal exposure, operational disruption, physical safety, cyber vulnerability, and stakeholder trust.

Organisations that continue to treat this as a separate social media problem will remain in a reactive crouch. Those that recognise it as an integrated enterprise threat — and respond with early detection, cross-functional authority, and disciplined decision-making — will be better positioned to protect trust, reduce harm, and sustain resilience in an increasingly volatile information environment.

Key Statistics at a Glance

• 130 brands analysed; 76 showed identifiable threats

• 1,271 hostile narrative threats detected across six months

• 25,053 messages linked to those threats

• ~3.37 billion views recorded where reach data was available

• ~71.5% of threats carried legal or regulatory signals

• ~56.1% carried physical-world risk signals

• Top five brands account for ~59% of all threats

• Median threat lifespan: just 2 days