5 Early Signals Before a Story Breaks

I have spent the last few years watching brands get blindsided by stories that were not, in any meaningful sense, a surprise. The volume curve looks vertical from the outside. From the inside of the data, it almost never is. The story leaked. The leak had structure. And the structure repeats.

What follows is the version of that pattern I have come to trust. Five precursor signals, in roughly the order they appear, in roughly the seventy-two hours before the headline lands. None of these are exotic. All of them are visible. The reason most teams miss them is not that the data is hidden. It is that the dashboard is built to count, and these signals are built to be read.

Why a 72-hour window, and why most brands miss it

Crisis monitoring vendors love the phrase "early warning system." Most of what gets sold under that label is a volume threshold and a sentiment alarm — fires at 3× baseline mentions or a twenty-point sentiment drop. That is a fine description of a crisis as documented in the standard industry guides, and a useless description of a crisis that has not arrived yet. The volume crosses 3× when the story has already broken.

The actually-useful window is the one before any of that registers. Academic work on social signal detection has documented precursor signals weeks ahead of crisis events — but for most brand stories the practical, operational window is closer to seventy-two hours. Three days. That's how long the signal usually leaks before the story crosses into the mainstream press, and three days is the difference between deciding what your statement says and reading what someone else said about you while you were getting ready.

The reason most teams miss it is not faint signal. The reason is that conventional brand monitoring scores tone instead of reading framing, counts volume instead of tracking imitation, and indexes mainstream press instead of the layers underneath it. The tools answer "is the brand being talked about more?" The right question for the seventy-two-hour window is something else entirely.

The five patterns, in order

Here is the structure I keep seeing. Five signals, roughly sequenced. They don't all fire on every story. But when three or more fire in the order below, you are inside a story that is going to break — and you have a few dozen hours to act on that knowledge before everyone else has it too.

Pattern 1 — The coordinated handoff

This is the one most people miss because it looks like nothing. A clip, a screenshot, or a quote shows up across three or four accounts within a few hours, with nearly-identical framing. The accounts don't share an obvious affiliation. The reach is small — thousands of impressions, not millions. A volume dashboard reads it as background noise.

It is not background noise. It is the moment a piece of content gets handed off from the surface where it was produced to the surface where it will spread. Coordinated handoffs are the connective tissue between the alt-platform and the mainstream feed. Once you've seen a few, the pattern is unmistakable: one source, three or four copies in close timing, all using the same hook.

The Bud Light pattern in early April 2023 is the textbook example. Mulvaney's March Madness video landed April 1. Within twenty-four hours, the same clip was being reposted across mid-reach Twitter accounts with framing that converged on a single read. The detailed timeline shows the handoff happening on April 1–2 — at total mention volumes that any conventional dashboard would have correctly described as small. The brand-side response window opened then. It closed about seventy-two hours later, when Kid Rock posted his video and the next pattern took over.

The diagnostic test is simple: if you sort the day's mentions by account size and see three to five mid-reach accounts using nearly the same language about you, in a window of a few hours, do not wait for the volume to confirm the signal. The volume will confirm the signal eight hours from now. By then it will be over.

Pattern 2 — The imitation template

This is the one that decides whether a story stays a moment or becomes a movement.

An imitation template is a piece of content with a clean, reproducible structure: a single gesture, a thirty-to-sixty-second format, a punchline anyone can copy. The Kid Rock submachine-gun video. The Riley Green lyric swap. The mid-2010s Tide Pod challenge. Any TikTok that produces a "duet this" instinct in the viewer. Templates are how cultural backlash actually distributes itself, because the act of copying is much faster than the act of reporting.

You can recognize an imitation template forming in real time. Within a few hours of the original posting, you start seeing variations: same gesture, different person, same product, same backyard. The variations are evidence the template is replicable, and replicability is what determines whether the story has another seventy-two hours of fuel.

Peloton lived inside this pattern after the Tread+ recall and the And Just Like That episode. The "Mr. Big has a Peloton-induced heart attack" gag became a copy-paste meme structure within twenty-four hours of the episode airing. By the time Peloton's commercial response was ready — Ryan Reynolds, Chris Noth, the works — the imitation template had been distributed for two days and the next round of imitation took the commercial itself as raw material when Noth was accused of misconduct days later. The template ate the response.

The diagnostic test: count not how many people are talking about you, but how many people are reproducing the same gesture about you. If the answer is more than thirty independent variations within twelve hours, you are inside a template event, not a discussion.

Pattern 3 — Source escalation

Source escalation is the pattern Boeing made famous — the 737 MAX coverage migrated from aviation trade press in late 2018 to congressional hearings by early 2019 with very little change in raw mention volume — and the one I've documented in detail elsewhere. A story climbs one tier. The volume barely moves. The composition of the speakers does.

For consumer stories the ladder is something like: anonymous forum → low-reach creator → mid-reach creator → specialist trade press → general business press → network news. For corporate stories it tends to be: industry trade publication → regional paper → national paper of record → wire pickup → broadcast. Each rung carries roughly an order of magnitude more reach than the last, and — more importantly — each rung licenses the next one. Reuters can write about it once Aviation Week has. The New York Times can write about it once the Seattle Times has. The rungs aren't independent. They release each other.

Silicon Valley Bank's collapse in March 2023 is a clean source-escalation read in retrospect. The whisper that something was wrong appeared in fintech-specific newsletters and VC-only Slack channels in the first half of the week. By Wednesday it was on tech-specialist trade press. By Thursday it was the Financial Times. By Friday morning, every limit-partner email chain in the country was forwarding the same Twitter thread, and the bank run was in progress. The depositors who got out got out on Wednesday and Thursday because they were reading the trade-press tier. The depositors who didn't get out were reading the network-news tier on Friday afternoon.

The diagnostic test: track the rung you're being covered on, not just the count of stories. If the story climbs a rung in twenty-four hours with no new precipitating event, the next rung will arrive on roughly the same cadence. The escalation curve is exponential and short. For a fuller framework on how these early signals cross from noise into consequence — and how to classify when a weak signal has become material enough to warrant decision-making bandwidth — I break that out separately.

Pattern 4 — Defensive coverage from friendly outlets

This is the one nobody puts on their early-warning slide because it looks, on the surface, like a win.

A columnist you know publishes a piece defending you. An industry analyst posts a thoughtful long-form on why the criticism is unfair. A friendly trade outlet runs an explainer that frames the situation in your favor. The sentiment scoring, predictably, codes all of it as positive. Some monitoring tools will mark it green and move on.

It is not a win. It is your communications system informing you that someone friendly thinks you need defending, and friendly people don't write pre-emptive defenses for stories that aren't coming. The mere existence of the defense is the signal. The content of the defense is, often, a leak about what the antagonist wave is going to focus on — because the friendly writer has already heard the criticism and is rebutting it before it lands at scale.

You can see the same dynamic everywhere. The op-eds defending the WeWork S-1 from sympathetic finance writers preceded the collapse of the IPO by about a week. The friendly retrospectives explaining "what people get wrong about" Theranos appeared in the first half of 2015, months before the Wall Street Journal story that ended the company. Meta's rebrand to a "metaverse company" in late 2021 was preceded by a wave of friendly business-press explainers on the metaverse opportunity — framed as forward-looking strategy — that appeared the same week internal whistleblower documents were being shared with Congress. The sympathetic framing was not coincidental; it was a tell that the company's allies knew what was coming and were laying groundwork. Every time, the defense looked like positive coverage. Every time, the defense was the leading indicator.

The diagnostic test: if a friendly outlet runs a defense piece without an obvious provocation in the prior twenty-four hours, treat it as a forty-eight-hour leading indicator that the antagonist version of the same argument is on its way. The friendly piece is your first read on what the antagonist piece will say.

Pattern 5 — Silent disengagement

This is the one nobody else has named, and it is the most under-read precursor in the entire window.

Think of a restaurant where the regulars suddenly stop showing up. Nobody posted a bad review. But the Tuesday crowd that has been coming for three years is not here this Tuesday, or the next. The manager who only watches the reservation book sees nothing. The bartender who knows the regulars by name sees everything.

Every brand has a loyalist layer — creators, ambassadors, partners, super-fans, employee advocates — who post about it consistently. Their cadence is reasonably steady week to week. When they fall silent, the silence is a signal. They have heard something. They are bracing. They don't want their feed associated with what is about to land. The dashboard, which only counts what gets said, registers nothing.

This is invisible to every brand-monitoring tool I've seen because every brand-monitoring tool I've seen is built around presence — keyword matches, mention counts, sentiment-of-what-was-posted. None are built around expected presence that didn't show up. There is no alert for "the seventy creators who normally tag you twice a week have all gone quiet for forty-eight hours." There should be.

You can see this pattern in the Balenciaga campaign episode in late 2022. In the days between the campaign images surfacing and the mainstream story breaking, a noticeable cohort of fashion creators who had previously posted Balenciaga content paused. Not posted criticism — paused. They knew. The mainstream press caught up about seventy-two hours later. The creators went back to posting about other brands.

The diagnostic test is the hardest of the five and the most rewarding when you build it. Here is the on-ramp I recommend to teams who want to start tomorrow:

1. Pick five to ten loyalist accounts per brand you cover. Not the brand's own accounts. Outside accounts that post about the brand on a steady cadence: a vocal customer, an ambassador, an industry analyst who covers you, a partner whose feed reflects yours. Write the list in a shared doc with the cadence you've observed (e.g., "Riley Green — 1-2 brand mentions per week; Jen Atkin — daily").
2. Run a weekly cadence audit. Every Monday, check how many of your loyalist accounts posted about the brand in the prior seven days. Track the number. Within four to six weeks you have a working baseline.
3. Set a single trigger. When the Monday number drops 50% or more from baseline for two consecutive weeks, with no obvious external explanation (a holiday week doesn't count), treat that as Pattern 5 firing and brief upward.

The list is small on purpose. Five accounts you actually know are more useful than five hundred you scrape. Two consecutive weeks is the right horizon — long enough to filter noise, short enough that you don't miss the window. The discipline is to look for absence on a schedule, because absence is the one thing the dashboard will never page you about.

The signals are not predictions

None of these patterns predict that a crisis will happen. They identify that a story is in motion and is following a pattern that has, repeatedly, ended in mainstream coverage within seventy-two hours. What they let you do inside that window is not "prevent the story." It is "decide your move before the story decides for you" — pre-empt, prepare leadership, move a planned launch, brief friendly reporters, do nothing on purpose. Those are different choices, all of them better than being asked for a comment by a Bloomberg reporter at 9:14 a.m.

The mistake conventional dashboards make is treating absence-of-volume as absence-of-story. The mistake sentiment scoring makes is treating absence-of-negative-tone as absence-of-risk. The mistake of most "early warning systems" is firing on the same condition that ends the window — the volume spike — and calling that early. It is not early. It is on time, where on-time is also too late. And when the system fires on every volume spike, the false alarms erode the team's escalation authority until the real signal is dismissed.

The five patterns above are early in a way the volume curve is not. They are findable because the content already exists in places that index easily once you know where to look, and they are diagnostic because they have repeated, with small variations, across nearly every brand event of the last decade I've reviewed. The infrastructure to read them is not exotic. The choice to read them — and to staff for it — is the part almost nobody has made yet.

The dashboard will not page you for a coordinated handoff. It will not flag an imitation template at thirty reproductions. It will not notice that the loyalist layer went quiet on Tuesday. Those are human reads, and they require a human who has been told to look for them. The five patterns are the briefing. The staffing decision is yours.