CyberShield

Coordinated campaigns are not hard to spot once you stop looking at posts and start looking at timing. A single account saying something inflammatory is noise. Two hundred accounts saying it within the same twenty minutes, having never interacted before, is a structure.

The detection worked on that shape rather than on the text, which made it harder to evade by rewording and much easier to explain to someone who is not an engineer. That mattered more than accuracy did in the room.

It won first place at the Cybercrime Investigation and Intelligence Summit in November 2025.

It is archived. It was built for a competition and I did not pretend afterwards that it was a product.