Crisis Detection: How to Tell a Spike From a Crisis

Crisis detection is the practice of telling a harmless spike in mentions from a real brand crisis. It works by measuring velocity against a brand’s own normal, who is talking, whether sentiment has shifted and whether the story will still exist tomorrow, rather than by counting volume.

Most crisis alerts are wrong. Not slightly wrong, but wrong in the specific way that trains a team to ignore them: they fire on a Tuesday because a sponsored post did unusually well, and they stay silent on the Thursday a trade publication runs the piece that will end up in the nationals by the weekend.

Both failures come from the same mistake, which is treating volume as the signal. It is the easiest thing to count and the least informative thing to know.

Why volume thresholds fail in both directions

A threshold is a number that says: if mentions exceed this, something is happening. The appeal is obvious. It is also why almost every monitoring tool ships with one, usually set by whoever configured the account in the first week, before anyone knew what normal looked like.

The first failure mode is the loud one. A large brand generates enough baseline noise that any threshold low enough to catch a genuine problem will also catch every product launch, every sponsorship activation, every mildly viral advert and every day a celebrity happens to mention the category. The team gets a notification, checks, finds nothing, and the alert loses a little credibility. Repeat that for three weeks and the alert has become something people close without reading.

The second failure mode is the quiet one, and it is more expensive. A genuine crisis frequently does not begin with a spike. It begins with one article in a publication your team does not read, or a single complaint thread that three people join, or a regulator’s filing that a specialist reporter noticed. The volume in the first twelve hours is indistinguishable from a slow day. By the time the volume arrives, so has the crisis, and detection has told you nothing you did not already know from the phone ringing.

A threshold catches the events that were always going to be obvious. It misses the ones where early warning would actually have been worth something.

What a baseline actually is

The fix starts with replacing the absolute number with a relative one, and that requires knowing what normal looks like for one specific brand, in one specific channel, on one specific kind of day.

Normal is not a single figure. A brand’s mention volume has structure in it: weekdays differ from weekends, mornings differ from evenings, and most categories have a seasonal shape that repeats. A retail brand in a sale week and the same brand three weeks later are not the same baseline, and treating them as one produces both false alarms and missed events at predictable times of year.

Normal is also channel-specific. Press volume and social volume behave nothing alike. Press arrives in small numbers with high individual significance. Social arrives in large numbers where any individual item means very little. A baseline that averages them together describes neither, and an alert built on that average fires on social noise while being numerically incapable of noticing that press coverage has quietly tripled from two articles to six.

And normal is subject-specific. Coverage of your brand, coverage of your chief executive and coverage of your category are three different baselines with three different shapes. A competitor’s crisis will lift category volume sharply while your own brand coverage stays flat, which is a genuinely useful thing to know and a completely different thing from a crisis of your own.

The practical requirement is a long enough history to have seen a few of your own normal cycles. A baseline built on two weeks of data mostly describes those two weeks.

The four signals that actually separate a spike from a crisis

Once you have a baseline, the question stops being how many and starts being what kind. Four things distinguish an event that matters from one that does not.

Velocity, meaning the rate of change rather than the level. A crisis has a characteristic acceleration. Volume doubling over six hours and then doubling again is a different shape from volume that jumps once and plateaus, even if both reach the same peak. The plateau is usually a single piece of content doing well. The compounding curve is usually a story being picked up and re-reported, which is what an actual crisis looks like from the outside. This is the reason crisis velocity measured against your own normal is worth building properly rather than approximating with a fixed number.

Composition, meaning who is talking. This is the signal most worth adding if you only add one. A thousand mentions from consumer accounts and eleven mentions that include two journalists, a trade reporter and an industry newsletter are not the same event, and the second one is more dangerous. Journalists entering a conversation is the strongest single predictor that a social story will become a press story, because it is literally the mechanism by which that happens. Watch for the transition, not the total.

Valence shift, meaning sentiment moving rather than volume moving. Volume without a sentiment change is usually attention, not damage. A brand can be mentioned ten times more than usual because something delightful happened. What matters is whether the tone of the conversation has moved relative to that brand’s own historical mix, which for some categories is substantially negative even on a good day. A brand that runs at thirty percent positive normally is not in crisis at twenty eight percent, and a brand that runs at seventy is in real trouble at fifty five. The absolute number means nothing without the history behind it.

Durability, meaning whether the story has a reason to still exist tomorrow. This is the hardest to automate and the most predictive. Ask what the second day of this story would be. If the answer is that there isn’t one, because the thing has been addressed, or it was a misunderstanding that resolved itself, or it is simply not interesting enough to develop, then the event is a spike regardless of its size. If there is an obvious next beat, a regulator who might comment, a victim who might be interviewed, a document that might be published, a competitor who might pile on, then the volume today is the smallest it will be.

Severity should escalate on evidence, not on size

A detection system that has only two states, quiet and alarm, forces every judgement into a binary that the situation rarely justifies. Most events deserve a middle setting: worth watching closely, not yet worth waking anyone.

A workable ladder has three rungs. The lowest is attention, which means something is outside normal and a person should look at it within the working day. The middle is elevated, which means two or more of the four signals above are present together, and the team should prepare a response even if it is never used. The top is critical, which means the thing has a name, a journalist, and a second day.

The important design rule is that movement between rungs should require new evidence rather than more volume. Ten thousand more mentions of the same harmless thing is still the same harmless thing. One journalist asking a question about it is an escalation. Building the ladder this way keeps the top rung meaningful, which is the only thing that makes it useful when it actually fires.

Cross-channel is where the real early warning lives

The most valuable detection signal available to a comms team is not inside any single channel. It is the relationship between them.

Social conversation moving while press stays flat is the ordinary early-warning pattern: something is building in public before any outlet has covered it, and that window, which might be hours or might be two days, is the only period in which a team can act before the story is fixed in print. This is the case for monitoring both in one place rather than in two separate tools that never quite agree.

Press moving while social stays flat is the opposite pattern and usually means a single outlet published something nobody has picked up. Often it stays that way. Sometimes it is the first article of four, and the thing to watch is whether a second outlet follows within the first day.

Both moving together, from a standing start, is the pattern that most reliably indicates a real event rather than an artefact of one platform.

There is now a fourth channel worth watching for the same reason. What assistants say about a brand changes more slowly than press or social, but when a crisis produces enough coverage to enter what models retrieve, the effect outlasts the news cycle by a long way. A story that was over in the press in a week can keep surfacing in AI answers for months, which is a different kind of exposure and one covered properly in the correction playbook.

What to automate and what never to

Automate the watching. No team can read every channel continuously in every language their brand appears in, and the entire value of a detection system is that it does the reading and hands back the short list.

Automate the narrowing. Getting from eleven thousand mentions to the nine that a human should look at this morning is exactly the kind of work software should do, and doing it well is most of what separates a useful system from an expensive feed.

Do not automate the judgement. Whether something is a crisis is a question about consequences, relationships, timing and context that no system has access to. A tool that announces a crisis rather than surfacing evidence is making a claim it cannot support, and the first time it is confidently wrong in front of a client is the last time anyone trusts its output.

Do not automate the response either, for the same reason. Drafting support is genuinely useful. Sending is a decision with consequences attached and belongs to a person whose name is on it.

The failure modes worth checking for in your own setup

The threshold was set during a quiet month. Very common, because tools get configured during onboarding, which is usually a deliberately calm period. Check what the baseline period was.

Community and search-discovery data is being counted as volume. Some sources can tell you a conversation exists but cannot honestly measure how big it is, because what is being counted is search-engine discovery rather than confirmed posts. Using that as a volume input produces spikes that reflect crawler behaviour rather than human behaviour.

Only English is being watched. For any brand operating across multiple language markets, this guarantees that the earliest version of a story is invisible. The first report of a local incident is almost never in English, and translation-after-detection means detection happened late by definition.

Sentiment is scored by one system for press and another for social. The two will disagree, and the disagreement will surface in the worst possible meeting. One engine across channels is the only way a cross-channel sentiment shift means anything.

Nobody has tested the alert. Run a drill. Send a deliberate test escalation at an awkward hour and find out whether the right person receives it, whether they know what to do, and whether the phone number in the system still belongs to someone who works there.

What good detection actually feels like

It is quieter than most teams expect. A well-tuned system produces very few alerts, most weeks none, and the ones it does produce get read carefully because they have earned it. The daily rhythm is a short check rather than a queue to clear.

And when something real does begin, the useful output is not a number. It is a specific claim with evidence attached: coverage of this subject is accelerating faster than it has in the last year, sentiment has moved sharply negative against its own baseline, two journalists have entered the conversation in the last hour, and here are the eleven items that show it. That is a thing a person can act on, and acting on it inside the first hour is the whole point. What to do with that hour is its own playbook.

The rest of the crisis stack, the velocity clock and the escalation logic behind it, is what crisis detection is built to run continuously so a team does not have to.

Common questions

How do you know if a social media spike is a real crisis?

Look past the volume at four things: how fast it is accelerating against your own normal rather than an absolute number, who is talking and whether journalists have joined, whether sentiment has shifted or just quantity, and whether the story has a mechanism to produce a second day. A spike with no sentiment shift and no press interest is usually noise.

What is a good alert threshold for crisis monitoring?

There is no good universal number, which is the whole problem with threshold-based alerting. A threshold that is sensible for a brand generating forty mentions a day will fire constantly for one generating four thousand, and never fire for one generating four. The threshold has to be derived from that specific brand's own baseline, per channel.

Can crisis detection be automated?

The watching can be automated and should be, because no human can monitor every channel continuously. The judgement cannot. A good system narrows thousands of mentions to the handful that might matter and shows its reasoning, then a person decides whether it is a crisis and what to do.

Why do crisis alerts produce so many false alarms?

Usually because they are tuned to absolute volume rather than to deviation from that brand's normal pattern, and because they ignore composition. A product launch, a sports sponsorship and a viral advert all produce volume spikes that look identical to a crisis if volume is the only thing being measured.

What kind of crisis does monitoring usually miss?

The slow-burn kind. A regulatory story, a quietly spreading complaint pattern, or a single article in a trade publication that will be picked up in four days never trips a volume threshold, because the volume never spikes. These are found by watching composition and sentiment drift rather than counting mentions.