What Is Narrative Intelligence?

Last updated: October 22, 2026

Why it matters to your mission. Adversaries no longer need a story to be false for it to work; they need it to spread. Narrative intelligence is how an analyst sees the coordinated machinery behind a message - the accounts, personas, and timing moving together - instead of arguing about the content one post at a time.

What is narrative intelligence?

Narrative intelligence studies influence operations by their behavior and network structure rather than by the truth value of individual posts. The field has deliberately shifted away from "fake news," because the most effective operations rarely rely on provably false content - they rely on coordinated, inauthentic amplification. The analytic question becomes: who is pushing this narrative, are they who they claim to be, and are they acting together?

Narrative intelligence vs. fact-checking

How does narrative intelligence work?

1. Observe public signals. Work from publicly available information - posts, accounts, timing, and cross-platform activity.
2. Resolve the actors. Recognize that many accounts, personas, and handles map to the same actor or network. This is entity resolution applied to online identity.
3. Map the coordination. Build an explicit graph of who amplifies whom, when, so coordinated clusters and inauthentic networks become visible.
4. Characterize the behavior. Describe the operation in a shared vocabulary of tactics and techniques, so findings are comparable and shareable across analysts and agencies.
5. Preserve provenance. Keep the evidence for every attribution attached, so a conclusion can be traced and defended.

What is coordinated inauthentic behavior?

Coordinated inauthentic behavior (CIB) is a behavior-centric concept, originated by social-media platforms, for networks of accounts that work together while misrepresenting who they are. It is the clearest example of the field's core shift: the violation is the coordinated deception, not the content. Related terms include influence operations (IO), information manipulation, and, for foreign actors, foreign information manipulation and interference (FIMI).

What is the DISARM framework?

DISARM (Disinformation Analysis and Risk Management) is an open-source framework that catalogs the tactics, techniques, and procedures of influence operations, modeled on the way the MITRE ATT&CK framework catalogs cyber behavior. Developed by experts from MITRE, Florida International University, and the Cognitive Security Collaborative, it gives analysts a common language to describe and share influence-operation behavior, and it has been adopted in U.S. and EU efforts against FIMI.

Why is narrative intelligence hard?

• Behavior, not content. The signal is in coordination and identity, which are spread thin across many accounts and platforms.
• Identity resolution. One actor runs many personas; linking them correctly (and not wrongly) is the central technical challenge.
• Scale and speed. Campaigns move faster than manual analysis, so correlation has to be at least partly automated - and still auditable.
• Attribution has consequences. Calling a network coordinated or foreign-run is a serious claim, so the evidence trail has to hold up.

What to look for in a narrative intelligence capability

• Does it resolve actors and personas across platforms, with the reasoning open to inspection?
• Does it map coordination into an explicit, inspectable network graph?
• Is every attribution auditable - traceable back to the public evidence and confidence?
• Do you own and control the analysis, or is it locked inside a vendor's proprietary model?
• Does it keep a human in the loop and work only from authorized, publicly available information?

How Torch.AI approaches narrative intelligence

Torch.AI treats narrative intelligence as an identity-resolution and network-analysis problem for government-owned reasoning infrastructure, on the analysis side of authorized, publicly available information:

• ORCUS connects to the public signals an analyst is authorized to use and normalizes them.
• NEXUS builds semantic representations that preserve meaning, time, and source.
• HALO applies graph-based reasoning to resolve personas to actors and map coordination into an explicit, inspectable network.

Because the infrastructure is government-owned and every step is traceable, an attribution stays inspectable, governable, and defensible - which is exactly what a claim about coordinated influence requires.

Talk to us about narrative intelligence for your mission ->

Primary sources

• DISARM Foundation - the open-source DISARM framework for influence-operation TTPs. disarm.foundation
• European External Action Service (EEAS) on Foreign Information Manipulation and Interference (FIMI). eeas.europa.eu
• MITRE ATT&CK - the cyber framework DISARM is modeled on. attack.mitre.org

What is the difference between narrative intelligence and fact-checking?

Fact-checking asks whether a specific claim is true or false. Narrative intelligence studies the behavior and network behind the messaging - who is amplifying what, together, and whether inauthentically - regardless of whether any single post is false. It catches operations built on true-but-weaponized or opinion content that fact-checking misses.

What is coordinated inauthentic behavior?

Coordinated inauthentic behavior (CIB) is a term, originated by social-media platforms, for networks of accounts that act together while misrepresenting who they are. The violation is the coordinated deception, not the content itself.

What is the DISARM framework?

DISARM (Disinformation Analysis and Risk Management) is an open-source framework that catalogs the tactics, techniques, and procedures of influence operations, modeled on MITRE ATT&CK. It gives analysts a shared vocabulary to describe and compare influence-operation behavior and is used in U.S. and EU efforts against foreign information manipulation.