The two faces of the concealed identity: the account as threat and as shield

The synthetic-persona surface

Foreign influence and online manipulation are usually handed to separate disciplines, counterintelligence for one and content moderation for the other. This brief asks whether the recruited insider and the AI-generated account are separate problems for a principal or one threat surface, and what would decide the question. Built from the firm's tradecraft analysis, read against its surveillance-economy kill chain. For security teams and family offices organizing defenses against impersonation and astroturf.

The relationship does not have to be fake: why the circle is the target

They Befriend Your Assistant, Not You

The FBI's 2025 Internet Crime Report, released in April 2026, recorded billions lost to business email compromise and to investment fraud built on online relationships. This brief asks why a hostile approach aimed at a principal may never contact the principal, and what control holds when the relationship being used is genuine. Built from threat-intelligence reporting on persona campaigns, Justice Department case records and the FBI report. For family offices deciding how far protection should reach beyond the principal.

Before you block: preserve, assess, then act

Block It Later. Capture It First.

A suspicious account surfaces around a principal or a household member, and the first impulse is to block it and move on. This brief works through what that impulse can cost, where the exceptions lie, and who in a household should make the call. Built from standard digital-evidence guidance, including NIST Special Publication 800-86, and the firm's protective practice. For family offices and security leads setting the rule staff and family follow in the first hour.

Synthetic consensus: coordination is not agreement, and deception is the offense

Count the Voices, Not the Noise

When a principal comes under sustained online attack, an early decision turns on whether the voices are as numerous and independent as they appear. This brief sets out a working vocabulary for coordinated inauthentic activity and a disciplined way to assess a wave, including what any finding must show. It draws on platform enforcement definitions, documented operations and the firm's casework. For principals, communications teams and counsel deciding how to respond.