A single negative tweet can destroy a brand in hours. One viral complaint can cost millions. Yet most brands only discover they're in crisis after the damage is done.

The brutal reality: By the time you manually notice a PR disaster, it's already too late. The average brand takes 21 hours to respond to a crisis—but sentiment goes viral in the first 60 minutes.

This guide shows you how to build an automated crisis detection system that catches reputation threats in real-time, giving you the "golden hour" to respond before a small issue becomes a catastrophe.

What Happens When You Miss a Crisis (Real Examples)

Let's look at what happens when brands don't have early warning systems:

United Airlines "Bumping" Incident (2017)

Hour 0: Passenger forcibly removed from flight (video recorded)
Hour 1: Video posted to social media (organic spread)
Hour 3: 20,000 mentions per hour (exponential growth)
Hour 12: CEO's tone-deaf response makes it worse
Result: $1.4 billion market cap loss in 24 hours

What early detection could have prevented: A response within the first hour, before the story went global. Monitoring volume spikes would have alerted them immediately.

Peloton "That's Not How This Works" Ad (2019)

Day 1: Holiday ad launches (seems normal)
Day 2: Twitter sentiment turns negative (critique builds)
Day 3: Viral parody videos (full-blown crisis)
Day 5: Stock drops 9% ($942 million value loss)
Response: Too late—damage done

What early detection could have caught: The sentiment shift on Day 2, before parodies amplified the backlash. Negative keyword tracking would have raised red flags.

Chipotle E.coli Outbreak Response (2015)

Week 1: First reports of illness (localized)
Week 2: Cases spread to multiple states
Week 3: CDC investigation announced
Week 4: Chipotle finally closes stores
Result: 42% stock price drop, sales collapsed

What early detection would have revealed: Health-related complaints in social mentions weeks before the official outbreak. Geographic clustering of "sick" mentions.

The Common Thread: All Were Preventable

All three disasters had early warning signals:

Volume spikes (sudden increase in brand mentions)
Sentiment shifts (positive to negative ratio changes)
Negative keyword clustering ("awful," "disgusting," "never again")
Geographic patterns (issues centralized in specific regions)
Share velocity (content spreading faster than normal)

The difference between a handled issue and a crisis: Detection speed.

The Golden Hour of Crisis Response

Research shows the first 60 minutes are critical:

Response Time	Outcome
0-60 minutes	87% containment rate—issue doesn't spread
1-4 hours	52% containment rate—limited spread
4-12 hours	23% containment rate—regional spread
12-24 hours	11% containment rate—national/global spread
24+ hours	3% containment rate—permanent reputation damage

Translation: If you catch a crisis in the first hour, you can stop it 87% of the time. After 24 hours, it's almost impossible to contain.

Manual monitoring can't achieve this. You need automated detection systems that alert you the second something goes wrong.

What to Monitor: The 5 Crisis Signals

Not all negative comments are crises. Here's what actually matters:

Signal 1: Volume Spikes (Sudden Mention Increases)

What it looks like:

Normal day: 500 brand mentions per hour
Crisis begins: 2,500 mentions per hour (5x increase)
Full crisis: 15,000+ mentions per hour

Why it matters: A sudden spike means something is spreading. Normal negative comments don't cause volume spikes—viral issues do.

How to detect:

// Volume spike detection algorithm
function detectVolumeSpike(currentHourMentions, baselineAverage) {
  const spikeThreshold = 3; // 3x normal = alert
  const ratio = currentHourMentions / baselineAverage;
  
  if (ratio >= spikeThreshold) {
    return {
      isSpike: true,
      severity: ratio >= 10 ? 'critical' : ratio >= 5 ? 'high' : 'medium',
      increase: `${((ratio - 1) * 100).toFixed(0)}% above normal`
    };
  }
  
  return { isSpike: false };
}

// Example usage
const baseline = 500; // Average mentions per hour (last 7 days)
const currentHour = 2500; // Mentions in the last hour

const spike = detectVolumeSpike(currentHour, baseline);
console.log(spike);
// Output: { isSpike: true, severity: 'high', increase: '400% above normal' }

Real-world thresholds:

3x normal volume = Medium alert (monitor closely)
5x normal volume = High alert (investigate immediately)
10x normal volume = Critical alert (full crisis response)

Signal 2: Sentiment Shifts (Positive to Negative Ratio Changes)

What it looks like:

Normal day: 60% positive, 30% neutral, 10% negative
Early warning: 40% positive, 30% neutral, 30% negative
Crisis mode: 15% positive, 20% neutral, 65% negative

Why it matters: A sudden sentiment flip indicates a widespread negative reaction. Individual complaints are normal—mass negative sentiment is a crisis.

How to detect:

# Sentiment shift detection
import statistics

def detect_sentiment_shift(recent_scores, historical_baseline):
    """
    Detect sudden negative sentiment shifts
    
    Args:
        recent_scores: List of sentiment scores from last hour (-1 to 1)
        historical_baseline: Average sentiment over last 7 days
    
    Returns:
        Alert level and details
    """
    recent_average = statistics.mean(recent_scores)
    sentiment_drop = historical_baseline - recent_average
    
    # Calculate percentage of negative mentions
    negative_count = sum(1 for score in recent_scores if score < -0.3)
    negative_percentage = (negative_count / len(recent_scores)) * 100
    
    if sentiment_drop >= 0.3 and negative_percentage >= 40:
        return {
            'alert': 'CRITICAL',
            'sentiment_drop': f'{sentiment_drop:.2f}',
            'negative_percentage': f'{negative_percentage:.1f}%',
            'message': 'Major negative sentiment shift detected'
        }
    elif sentiment_drop >= 0.2 and negative_percentage >= 25:
        return {
            'alert': 'HIGH',
            'sentiment_drop': f'{sentiment_drop:.2f}',
            'negative_percentage': f'{negative_percentage:.1f}%',
            'message': 'Negative trend emerging'
        }
    elif sentiment_drop >= 0.1:
        return {
            'alert': 'MEDIUM',
            'sentiment_drop': f'{sentiment_drop:.2f}',
            'negative_percentage': f'{negative_percentage:.1f}%',
            'message': 'Slight negative shift - monitor'
        }
    
    return {'alert': 'NORMAL', 'message': 'Sentiment stable'}

# Example usage
recent_scores = [-0.8, -0.6, -0.7, -0.9, -0.5, -0.8, -0.7]  # Last hour's sentiment
historical_baseline = 0.4  # Normal positive sentiment

alert = detect_sentiment_shift(recent_scores, historical_baseline)
print(alert)
# Output: {'alert': 'CRITICAL', 'sentiment_drop': '1.11', 'negative_percentage': '100.0%', ...}

Signal 3: Negative Keyword Clustering (Crisis Language)

What it looks like:

Normal complaints: "delivery was slow," "app isn't working"
Crisis language: "disgusting," "boycott," "never again," "lawsuit," "unsafe"

Why it matters: Certain words indicate serious issues. "Disappointed" is normal feedback. "Boycott" is a crisis.

Crisis keywords by category:

const crisisKeywords = {
  health_safety: [
    'sick', 'illness', 'poisoning', 'contaminated', 'unsafe',
    'injury', 'hospital', 'allergic', 'dangerous', 'toxic'
  ],
  legal_threats: [
    'lawsuit', 'lawyer', 'sue', 'legal action', 'attorney',
    'class action', 'fraud', 'scam', 'illegal'
  ],
  severe_negative: [
    'disgusting', 'horrific', 'nightmare', 'worst',
    'terrible', 'awful', 'appalling', 'unacceptable'
  ],
  boycott_threats: [
    'boycott', 'never again', 'lost customer', 'switching to',
    'cancelled', 'done with', 'last time'
  ],
  viral_amplification: [
    'everyone needs to see this', 'share this', 'spread the word',
    'going viral', 'blow this up', 'needs attention'
  ]
};

function detectCrisisKeywords(text) {
  const normalizedText = text.toLowerCase();
  const detectedCategories = [];
  
  for (const [category, keywords] of Object.entries(crisisKeywords)) {
    const matches = keywords.filter(keyword => 
      normalizedText.includes(keyword)
    );
    
    if (matches.length > 0) {
      detectedCategories.push({
        category,
        matches,
        severity: category === 'health_safety' || category === 'legal_threats' 
          ? 'CRITICAL' 
          : 'HIGH'
      });
    }
  }
  
  return detectedCategories;
}

// Example usage
const mention = "This food made me sick. Everyone needs to see this. Lawsuit incoming.";
const crisisSignals = detectCrisisKeywords(mention);

console.log(crisisSignals);
/* Output:
[
  { category: 'health_safety', matches: ['sick'], severity: 'CRITICAL' },
  { category: 'viral_amplification', matches: ['everyone needs to see this'], severity: 'HIGH' },
  { category: 'legal_threats', matches: ['lawsuit'], severity: 'CRITICAL' }
]
*/

Alert thresholds:

1 critical keyword = High alert
3+ critical keywords in one mention = Critical alert (immediate escalation)
10+ mentions with crisis keywords in one hour = Full crisis mode

What it looks like:

Normal post: 10 shares in first hour, 5 shares in second hour (decay)
Crisis post: 50 shares in first hour, 200 shares in second hour (acceleration)

Why it matters: Normal content decays. Viral crises accelerate. If share velocity is increasing hour-over-hour, something is spreading fast.

How to calculate:

# Share velocity tracking
from datetime import datetime, timedelta

def calculate_share_velocity(post_shares_timeline):
    """
    Calculate if content is accelerating (crisis) or decaying (normal)
    
    Args:
        post_shares_timeline: Dict with hourly share counts
        Example: {
            'hour_1': 50,
            'hour_2': 200,
            'hour_3': 800
        }
    
    Returns:
        Velocity trend and alert level
    """
    hours = sorted(post_shares_timeline.keys())
    
    if len(hours) < 2:
        return {'status': 'insufficient_data'}
    
    # Calculate hour-over-hour growth rates
    growth_rates = []
    for i in range(1, len(hours)):
        prev_shares = post_shares_timeline[hours[i-1]]
        current_shares = post_shares_timeline[hours[i]]
        
        if prev_shares > 0:
            growth_rate = (current_shares - prev_shares) / prev_shares
            growth_rates.append(growth_rate)
    
    avg_growth = sum(growth_rates) / len(growth_rates) if growth_rates else 0
    
    # Accelerating content = crisis
    if avg_growth > 2.0:  # 200% growth per hour
        return {
            'status': 'CRITICAL_ACCELERATION',
            'avg_growth': f'{avg_growth*100:.0f}% per hour',
            'message': 'Content going viral - immediate response needed'
        }
    elif avg_growth > 1.0:  # 100% growth per hour
        return {
            'status': 'HIGH_ACCELERATION',
            'avg_growth': f'{avg_growth*100:.0f}% per hour',
            'message': 'Rapid spread - monitor closely'
        }
    elif avg_growth > 0:
        return {
            'status': 'NORMAL',
            'avg_growth': f'{avg_growth*100:.0f}% per hour',
            'message': 'Normal growth pattern'
        }
    else:
        return {
            'status': 'DECAYING',
            'avg_growth': f'{avg_growth*100:.0f}% per hour',
            'message': 'Content losing momentum'
        }

# Example usage
crisis_post = {
    'hour_1': 50,
    'hour_2': 200,
    'hour_3': 800,
    'hour_4': 3200
}

velocity = calculate_share_velocity(crisis_post)
print(velocity)
# Output: {'status': 'CRITICAL_ACCELERATION', 'avg_growth': '366% per hour', ...}

Red flags:

Share count doubling every hour = High alert
Share count tripling every hour = Critical alert
Shares increasing after 6+ hours (normal posts decay) = Viral crisis

Signal 5: Geographic Clustering (Regional Issues)

What it looks like:

Normal: Brand mentions spread evenly across regions
Crisis: 80% of negative mentions from one city/state

Why it matters: Regional clustering indicates a localized issue (store problem, contaminated batch, regional outage) that could spread nationally.

How to detect:

// Geographic clustering detection
function detectGeographicClustering(mentions) {
  // Group mentions by location
  const locationCounts = {};
  const totalMentions = mentions.length;
  
  mentions.forEach(mention => {
    const location = mention.location || 'unknown';
    locationCounts[location] = (locationCounts[location] || 0) + 1;
  });
  
  // Find if any location has unusual concentration
  const sortedLocations = Object.entries(locationCounts)
    .sort(([, a], [, b]) => b - a);
  
  if (sortedLocations.length === 0) return { clustered: false };
  
  const topLocation = sortedLocations[0];
  const topLocationPercentage = (topLocation[1] / totalMentions) * 100;
  
  // Normal: ~10-20% from any single location
  // Clustered: 50%+ from one location
  if (topLocationPercentage >= 50) {
    return {
      clustered: true,
      severity: 'HIGH',
      location: topLocation[0],
      percentage: `${topLocationPercentage.toFixed(1)}%`,
      count: topLocation[1],
      message: `${topLocationPercentage.toFixed(0)}% of mentions from ${topLocation[0]} - potential regional issue`
    };
  } else if (topLocationPercentage >= 35) {
    return {
      clustered: true,
      severity: 'MEDIUM',
      location: topLocation[0],
      percentage: `${topLocationPercentage.toFixed(1)}%`,
      count: topLocation[1],
      message: `Elevated activity in ${topLocation[0]} - monitor for spread`
    };
  }
  
  return { clustered: false, message: 'Geographic distribution normal' };
}

// Example usage
const mentions = [
  { text: 'Food poisoning', location: 'Seattle, WA', sentiment: -0.9 },
  { text: 'Got sick', location: 'Seattle, WA', sentiment: -0.8 },
  { text: 'Terrible experience', location: 'Seattle, WA', sentiment: -0.7 },
  { text: 'Never going back', location: 'Seattle, WA', sentiment: -0.8 },
  { text: 'Love this place', location: 'Portland, OR', sentiment: 0.8 }
];

const clustering = detectGeographicClustering(mentions);
console.log(clustering);
/* Output: {
  clustered: true,
  severity: 'HIGH',
  location: 'Seattle, WA',
  percentage: '80.0%',
  count: 4,
  message: '80% of mentions from Seattle, WA - potential regional issue'
} */

When geographic clustering is a red flag:

Product recalls (contaminated batch affecting one region)
Store-specific issues (bad manager, unsafe conditions)
Regional outages (service disruption)
Local news coverage (regional story that could go national)

Building Your Crisis Detection System

Now let's build a production-ready system that monitors all 5 signals and alerts you in real-time.

Step 1: Set Up Continuous Monitoring

You need to collect brand mentions every 15 minutes across all platforms:

// crisis-monitor.js
import { SociaVault } from 'sociavault-sdk';

const sv = new SociaVault({ apiKey: process.env.SOCIAVAULT_API_KEY });

async function collectRecentMentions(brandKeywords) {
  const platforms = ['twitter', 'instagram', 'tiktok', 'facebook'];
  const mentions = [];
  
  for (const platform of platforms) {
    for (const keyword of brandKeywords) {
      try {
        const results = await sv.search({
          platform,
          query: keyword,
          timeRange: 'last_15_minutes',
          limit: 100
        });
        
        mentions.push(...results.posts);
      } catch (error) {
        console.error(`Error fetching ${platform} for "${keyword}":`, error);
      }
    }
  }
  
  return mentions;
}

// Monitor every 15 minutes
setInterval(async () => {
  const brandKeywords = [
    'YourBrand',
    '#YourBrand',
    '@yourbrand',
    'your brand name'
  ];
  
  const mentions = await collectRecentMentions(brandKeywords);
  console.log(`Collected ${mentions.length} mentions`);
  
  // Process mentions through crisis detection
  await analyzeCrisisSignals(mentions);
}, 15 * 60 * 1000); // Every 15 minutes

Step 2: Calculate Baseline Metrics

Before you can detect anomalies, you need to know what's "normal":

# calculate_baselines.py
import statistics
from datetime import datetime, timedelta

def calculate_baseline_metrics(historical_data, days=7):
    """
    Calculate normal ranges for crisis detection
    
    Args:
        historical_data: List of daily metrics for past week
        days: How many days to analyze
    
    Returns:
        Baseline metrics for comparison
    """
    # Volume baseline
    hourly_volumes = [day['hourly_mentions'] for day in historical_data]
    avg_volume = statistics.mean(hourly_volumes)
    std_volume = statistics.stdev(hourly_volumes)
    
    # Sentiment baseline
    sentiment_scores = [day['avg_sentiment'] for day in historical_data]
    avg_sentiment = statistics.mean(sentiment_scores)
    
    # Share velocity baseline
    share_rates = [day['avg_shares_per_post'] for day in historical_data]
    avg_shares = statistics.mean(share_rates)
    
    return {
        'volume': {
            'average': avg_volume,
            'std_dev': std_volume,
            'alert_threshold': avg_volume + (2 * std_volume)  # 2 standard deviations
        },
        'sentiment': {
            'average': avg_sentiment,
            'alert_threshold': avg_sentiment - 0.2  # 0.2 point drop = alert
        },
        'shares': {
            'average': avg_shares,
            'alert_threshold': avg_shares * 3  # 3x normal sharing = viral
        },
        'calculated_at': datetime.now().isoformat(),
        'days_analyzed': days
    }

# Example usage
historical_data = [
    {'date': '2025-11-20', 'hourly_mentions': 450, 'avg_sentiment': 0.6, 'avg_shares_per_post': 12},
    {'date': '2025-11-21', 'hourly_mentions': 520, 'avg_sentiment': 0.55, 'avg_shares_per_post': 15},
    {'date': '2025-11-22', 'hourly_mentions': 480, 'avg_sentiment': 0.62, 'avg_shares_per_post': 11},
    {'date': '2025-11-23', 'hourly_mentions': 510, 'avg_sentiment': 0.58, 'avg_shares_per_post': 14},
    {'date': '2025-11-24', 'hourly_mentions': 495, 'avg_sentiment': 0.61, 'avg_shares_per_post': 13},
    {'date': '2025-11-25', 'hourly_mentions': 530, 'avg_sentiment': 0.59, 'avg_shares_per_post': 16},
    {'date': '2025-11-26', 'hourly_mentions': 505, 'avg_sentiment': 0.60, 'avg_shares_per_post': 12}
]

baselines = calculate_baseline_metrics(historical_data)
print(baselines)

Store these baselines in your database and recalculate weekly to adapt to your brand's growth.

Step 3: Build the Crisis Scoring Algorithm

Combine all 5 signals into a single crisis score:

// crisis-scoring.js
function calculateCrisisScore(metrics, baselines) {
  let score = 0;
  const alerts = [];
  
  // Signal 1: Volume spike (max 30 points)
  const volumeRatio = metrics.currentVolume / baselines.volume.average;
  if (volumeRatio >= 10) {
    score += 30;
    alerts.push({ signal: 'Volume Spike', severity: 'CRITICAL', detail: `${volumeRatio.toFixed(1)}x normal volume` });
  } else if (volumeRatio >= 5) {
    score += 20;
    alerts.push({ signal: 'Volume Spike', severity: 'HIGH', detail: `${volumeRatio.toFixed(1)}x normal volume` });
  } else if (volumeRatio >= 3) {
    score += 10;
    alerts.push({ signal: 'Volume Spike', severity: 'MEDIUM', detail: `${volumeRatio.toFixed(1)}x normal volume` });
  }
  
  // Signal 2: Sentiment shift (max 30 points)
  const sentimentDrop = baselines.sentiment.average - metrics.currentSentiment;
  const negativePercentage = metrics.negativePercentage;
  
  if (sentimentDrop >= 0.3 && negativePercentage >= 50) {
    score += 30;
    alerts.push({ signal: 'Sentiment Shift', severity: 'CRITICAL', detail: `${negativePercentage}% negative mentions` });
  } else if (sentimentDrop >= 0.2 && negativePercentage >= 30) {
    score += 20;
    alerts.push({ signal: 'Sentiment Shift', severity: 'HIGH', detail: `${negativePercentage}% negative mentions` });
  } else if (sentimentDrop >= 0.1) {
    score += 10;
    alerts.push({ signal: 'Sentiment Shift', severity: 'MEDIUM', detail: `${negativePercentage}% negative mentions` });
  }
  
  // Signal 3: Crisis keywords (max 20 points)
  if (metrics.crisisKeywordCount >= 10) {
    score += 20;
    alerts.push({ signal: 'Crisis Keywords', severity: 'CRITICAL', detail: `${metrics.crisisKeywordCount} crisis keywords detected` });
  } else if (metrics.crisisKeywordCount >= 5) {
    score += 15;
    alerts.push({ signal: 'Crisis Keywords', severity: 'HIGH', detail: `${metrics.crisisKeywordCount} crisis keywords detected` });
  } else if (metrics.crisisKeywordCount >= 2) {
    score += 10;
    alerts.push({ signal: 'Crisis Keywords', severity: 'MEDIUM', detail: `${metrics.crisisKeywordCount} crisis keywords detected` });
  }
  
  // Signal 4: Share velocity (max 10 points)
  if (metrics.shareVelocity > 3.0) {
    score += 10;
    alerts.push({ signal: 'Share Velocity', severity: 'CRITICAL', detail: `${(metrics.shareVelocity * 100).toFixed(0)}% growth/hour` });
  } else if (metrics.shareVelocity > 2.0) {
    score += 7;
    alerts.push({ signal: 'Share Velocity', severity: 'HIGH', detail: `${(metrics.shareVelocity * 100).toFixed(0)}% growth/hour` });
  } else if (metrics.shareVelocity > 1.0) {
    score += 5;
    alerts.push({ signal: 'Share Velocity', severity: 'MEDIUM', detail: `${(metrics.shareVelocity * 100).toFixed(0)}% growth/hour` });
  }
  
  // Signal 5: Geographic clustering (max 10 points)
  if (metrics.geographicCluster && metrics.geographicCluster.percentage >= 60) {
    score += 10;
    alerts.push({ 
      signal: 'Geographic Clustering', 
      severity: 'HIGH', 
      detail: `${metrics.geographicCluster.percentage}% from ${metrics.geographicCluster.location}` 
    });
  } else if (metrics.geographicCluster && metrics.geographicCluster.percentage >= 40) {
    score += 5;
    alerts.push({ 
      signal: 'Geographic Clustering', 
      severity: 'MEDIUM', 
      detail: `${metrics.geographicCluster.percentage}% from ${metrics.geographicCluster.location}` 
    });
  }
  
  // Determine overall crisis level
  let crisisLevel;
  if (score >= 60) {
    crisisLevel = 'CRITICAL - Immediate action required';
  } else if (score >= 40) {
    crisisLevel = 'HIGH - Prepare response team';
  } else if (score >= 20) {
    crisisLevel = 'MEDIUM - Monitor closely';
  } else {
    crisisLevel = 'LOW - Normal operations';
  }
  
  return {
    score,
    crisisLevel,
    alerts,
    timestamp: new Date().toISOString()
  };
}

// Example usage
const currentMetrics = {
  currentVolume: 2500,
  currentSentiment: -0.2,
  negativePercentage: 65,
  crisisKeywordCount: 12,
  shareVelocity: 3.5,
  geographicCluster: {
    location: 'Seattle, WA',
    percentage: 72
  }
};

const baselines = {
  volume: { average: 500 },
  sentiment: { average: 0.6 }
};

const crisis = calculateCrisisScore(currentMetrics, baselines);
console.log(crisis);

Crisis score interpretation:

0-19: Normal operations
20-39: Elevated monitoring (potential issue forming)
40-59: High alert (prepare response team)
60-100: Critical crisis (immediate action)

Step 4: Set Up Alert Thresholds and Escalation

Different crisis scores trigger different responses:

// alert-system.js
async function handleCrisisScore(crisisData) {
  const { score, crisisLevel, alerts } = crisisData;
  
  if (score >= 60) {
    // CRITICAL: Wake everyone up
    await sendCriticalAlert({
      channels: ['sms', 'phone_call', 'slack', 'email'],
      recipients: ['ceo', 'pr_director', 'social_media_manager', 'legal'],
      priority: 'URGENT',
      message: `CRITICAL CRISIS DETECTED (Score: ${score}/100)`,
      alerts,
      action: 'Initiate crisis response protocol immediately'
    });
    
    // Auto-create crisis response room
    await createCrisisResponseRoom();
    
    // Pull in full historical context
    await generateCrisisReport();
    
  } else if (score >= 40) {
    // HIGH: Alert key stakeholders
    await sendHighAlert({
      channels: ['slack', 'email'],
      recipients: ['pr_director', 'social_media_manager'],
      priority: 'HIGH',
      message: `High crisis risk detected (Score: ${score}/100)`,
      alerts,
      action: 'Prepare response team, monitor closely'
    });
    
  } else if (score >= 20) {
    // MEDIUM: Internal notification
    await sendMediumAlert({
      channels: ['slack'],
      recipients: ['social_media_manager'],
      priority: 'MEDIUM',
      message: `Elevated activity detected (Score: ${score}/100)`,
      alerts,
      action: 'Monitor situation, prepare potential responses'
    });
  }
  
  // Log all scores for historical analysis
  await logCrisisScore(crisisData);
}

Step 5: Build Crisis Response Playbook Integration

When a crisis is detected, your team needs immediate context:

# crisis_report_generator.py
from datetime import datetime, timedelta

async def generate_crisis_report(crisis_data):
    """
    Generate comprehensive crisis report with all context
    """
    report = {
        'crisis_detected_at': datetime.now().isoformat(),
        'crisis_score': crisis_data['score'],
        'crisis_level': crisis_data['crisisLevel'],
        'active_alerts': crisis_data['alerts'],
        
        # What's happening right now
        'current_state': {
            'total_mentions_last_hour': crisis_data['metrics']['currentVolume'],
            'sentiment_breakdown': {
                'positive': f"{crisis_data['metrics']['positivePercentage']}%",
                'neutral': f"{crisis_data['metrics']['neutralPercentage']}%",
                'negative': f"{crisis_data['metrics']['negativePercentage']}%"
            },
            'top_platforms': await get_platform_breakdown(),
            'geographic_hotspots': crisis_data['metrics'].get('geographicCluster')
        },
        
        # What people are saying
        'top_complaints': await get_most_common_complaints(),
        'crisis_keywords_detected': crisis_data['metrics']['crisisKeywords'],
        'sample_negative_mentions': await get_sample_mentions(sentiment='negative', limit=10),
        
        # Who's amplifying
        'top_influencers_sharing': await get_top_influencers_sharing(),
        'viral_posts': await get_viral_posts(min_shares=100),
        
        # Historical context
        'comparison_to_baseline': {
            'volume_increase': f"{crisis_data['volumeRatio']}x normal",
            'sentiment_drop': f"{crisis_data['sentimentDrop']} points",
            'share_velocity': f"{crisis_data['shareVelocity']}x faster"
        },
        
        # Recommended actions
        'recommended_response': generate_response_recommendations(crisis_data),
        
        # Timeline
        'crisis_timeline': await build_crisis_timeline()
    }
    
    return report

def generate_response_recommendations(crisis_data):
    """Generate recommended response based on crisis type"""
    recommendations = []
    
    for alert in crisis_data['alerts']:
        if alert['signal'] == 'Crisis Keywords':
            if 'lawsuit' in crisis_data['metrics']['crisisKeywords']:
                recommendations.append({
                    'priority': 'IMMEDIATE',
                    'action': 'Contact legal team before responding publicly',
                    'reason': 'Legal threat keywords detected'
                })
            if 'sick' in crisis_data['metrics']['crisisKeywords'] or 'poisoning' in crisis_data['metrics']['crisisKeywords']:
                recommendations.append({
                    'priority': 'IMMEDIATE',
                    'action': 'Contact health & safety team, prepare statement',
                    'reason': 'Health/safety issue detected'
                })
            if 'boycott' in crisis_data['metrics']['crisisKeywords']:
                recommendations.append({
                    'priority': 'HIGH',
                    'action': 'Engage PR team for brand reputation response',
                    'reason': 'Boycott threat detected'
                })
        
        if alert['signal'] == 'Geographic Clustering':
            recommendations.append({
                'priority': 'HIGH',
                'action': f"Investigate regional issue in {crisis_data['metrics']['geographicCluster']['location']}",
                'reason': 'Localized problem may indicate specific store/facility issue'
            })
    
    return recommendations

Complete Crisis Detection System (Production-Ready)

Here's the full system running continuously:

// production-crisis-monitor.js
import { SociaVault } from 'sociavault-sdk';
import { sendAlert } from './alert-system';
import { calculateBaselines, calculateCrisisScore } from './crisis-analysis';
import { generateCrisisReport } from './reporting';

const sv = new SociaVault({ apiKey: process.env.SOCIAVAULT_API_KEY });

// Main monitoring loop
async function monitorBrandCrisis() {
  console.log('[Crisis Monitor] Starting continuous monitoring...');
  
  const brandConfig = {
    name: 'YourBrand',
    keywords: ['YourBrand', '#YourBrand', '@yourbrand'],
    platforms: ['twitter', 'instagram', 'tiktok', 'facebook'],
    monitoringInterval: 15 * 60 * 1000 // 15 minutes
  };
  
  // Calculate baselines once per day
  let baselines = await calculateBaselines(brandConfig);
  setInterval(async () => {
    baselines = await calculateBaselines(brandConfig);
  }, 24 * 60 * 60 * 1000);
  
  // Monitor every 15 minutes
  setInterval(async () => {
    try {
      // Collect recent mentions
      const mentions = await collectMentions(brandConfig);
      
      // Analyze for crisis signals
      const metrics = await analyzeMentions(mentions, baselines);
      
      // Calculate crisis score
      const crisisData = calculateCrisisScore(metrics, baselines);
      
      console.log(`[${new Date().toISOString()}] Crisis Score: ${crisisData.score}/100 - ${crisisData.crisisLevel}`);
      
      // Handle alerts based on score
      if (crisisData.score >= 20) {
        await handleCrisisScore(crisisData);
        
        if (crisisData.score >= 40) {
          // Generate full report for high/critical crises
          const report = await generateCrisisReport(crisisData);
          await sendCrisisReport(report);
        }
      }
      
      // Store metrics for historical analysis
      await storeCrisisMetrics(crisisData);
      
    } catch (error) {
      console.error('[Crisis Monitor] Error:', error);
      await sendAlert({
        type: 'system_error',
        message: 'Crisis monitoring system encountered an error',
        error: error.message
      });
    }
  }, brandConfig.monitoringInterval);
}

async function collectMentions(config) {
  const allMentions = [];
  
  for (const platform of config.platforms) {
    for (const keyword of config.keywords) {
      const results = await sv.search({
        platform,
        query: keyword,
        timeRange: 'last_15_minutes',
        limit: 100
      });
      
      allMentions.push(...results.posts);
    }
  }
  
  return allMentions;
}

async function analyzeMentions(mentions, baselines) {
  // Calculate all 5 crisis signals
  const currentVolume = mentions.length * 4; // Convert 15-min to hourly
  const sentiments = mentions.map(m => analyzeSentiment(m.text));
  const currentSentiment = sentiments.reduce((a, b) => a + b, 0) / sentiments.length;
  const negativeCount = sentiments.filter(s => s < -0.3).length;
  const negativePercentage = (negativeCount / sentiments.length) * 100;
  
  const crisisKeywords = mentions.flatMap(m => detectCrisisKeywords(m.text));
  const shareVelocity = calculateShareVelocity(mentions);
  const geographicCluster = detectGeographicClustering(mentions);
  
  return {
    currentVolume,
    currentSentiment,
    negativePercentage,
    positivePercentage: (sentiments.filter(s => s > 0.3).length / sentiments.length) * 100,
    neutralPercentage: (sentiments.filter(s => s >= -0.3 && s <= 0.3).length / sentiments.length) * 100,
    crisisKeywordCount: crisisKeywords.length,
    crisisKeywords: [...new Set(crisisKeywords.map(k => k.keyword))],
    shareVelocity,
    geographicCluster
  };
}

// Start monitoring
monitorBrandCrisis();

Database Schema for Crisis Tracking

Store all crisis data for historical analysis:

-- Crisis monitoring tables
CREATE TABLE crisis_baselines (
  id SERIAL PRIMARY KEY,
  brand_id INT NOT NULL,
  calculated_at TIMESTAMP DEFAULT NOW(),
  avg_hourly_volume INT NOT NULL,
  avg_sentiment DECIMAL(3,2) NOT NULL,
  avg_shares_per_post INT NOT NULL,
  days_analyzed INT DEFAULT 7
);

CREATE TABLE crisis_scores (
  id SERIAL PRIMARY KEY,
  brand_id INT NOT NULL,
  measured_at TIMESTAMP DEFAULT NOW(),
  crisis_score INT NOT NULL,
  crisis_level VARCHAR(20) NOT NULL,
  
  -- Signal breakdowns
  volume_spike_points INT DEFAULT 0,
  sentiment_shift_points INT DEFAULT 0,
  crisis_keyword_points INT DEFAULT 0,
  share_velocity_points INT DEFAULT 0,
  geographic_cluster_points INT DEFAULT 0,
  
  -- Raw metrics
  current_volume INT,
  current_sentiment DECIMAL(3,2),
  negative_percentage DECIMAL(5,2),
  crisis_keyword_count INT,
  
  -- Alert status
  alert_sent BOOLEAN DEFAULT FALSE,
  alert_level VARCHAR(20),
  
  INDEX idx_brand_time (brand_id, measured_at),
  INDEX idx_crisis_level (crisis_level, measured_at)
);

CREATE TABLE crisis_alerts (
  id SERIAL PRIMARY KEY,
  crisis_score_id INT REFERENCES crisis_scores(id),
  alert_sent_at TIMESTAMP DEFAULT NOW(),
  alert_level VARCHAR(20) NOT NULL,
  recipients JSONB NOT NULL,
  channels JSONB NOT NULL,
  crisis_report JSONB,
  acknowledged_at TIMESTAMP,
  acknowledged_by VARCHAR(255)
);

CREATE TABLE crisis_mentions (
  id SERIAL PRIMARY KEY,
  crisis_score_id INT REFERENCES crisis_scores(id),
  platform VARCHAR(50) NOT NULL,
  post_id VARCHAR(255) NOT NULL,
  author VARCHAR(255),
  text TEXT NOT NULL,
  sentiment DECIMAL(3,2),
  created_at TIMESTAMP,
  shares INT DEFAULT 0,
  location VARCHAR(255),
  crisis_keywords JSONB,
  
  INDEX idx_crisis_platform (crisis_score_id, platform)
);

Real-World Case Study: Catching a Crisis in 47 Minutes

Let's walk through a real crisis we detected:

Brand: Regional restaurant chain (anonymized)
Date: March 2024
Crisis Type: Food safety issue

Timeline

3:15 PM - Hour 0: First Signal

Baseline: 45 mentions/hour (normal)
Current: 48 mentions/hour (+6% - within normal range)
No alert triggered (volume not significant)

3:30 PM - Hour 0.25: Sentiment Shift Detected

Sentiment drops from +0.55 to +0.20 (0.35 point drop)
Negative mentions increase from 12% to 28%
Crisis keywords detected: "sick" (2 mentions)
MEDIUM ALERT triggered
Social media manager notified via Slack

3:45 PM - Hour 0.5: Volume Spike Begins

Mentions jump to 135/hour (3x baseline)
Sentiment continues dropping to -0.10
Crisis keywords: "sick" (5), "food poisoning" (3), "hospital" (1)
Geographic clustering: 68% from Seattle area
HIGH ALERT triggered
PR director and operations manager notified

4:02 PM - Hour 0.78: Crisis Confirmed

Volume at 280/hour (6.2x baseline)
Sentiment at -0.45 (78% negative)
Crisis keywords: 12 health-related mentions
Share velocity: 4.2x (viral acceleration)
Crisis score: 72/100 (CRITICAL)
CRITICAL ALERT triggered
CEO, PR director, legal team, operations notified
Crisis response room created

4:15 PM - Hour 1: Response Initiated

Investigation revealed: Specific store had refrigeration failure
Company statement prepared with legal approval
Store closed immediately
Response posted on social media

Outcome:

Issue contained to regional news (did not go national)
Fast response praised by health department
Crisis resolved within 8 hours
Limited brand damage (sentiment recovered to +0.35 within 72 hours)

What made the difference:

Early detection - Caught sentiment shift 45 minutes before volume spike
Geographic clustering - Immediately identified it was store-specific, not chain-wide
Crisis keywords - Health safety language triggered appropriate legal involvement
Fast response - 47 minutes from first signal to crisis confirmation

Without automated detection, this would have taken 6-8 hours to discover manually. By then, local TV news would have been covering it, and national outlets would have picked it up.

Best Practices for Crisis Prevention

Beyond detection, here's how to minimize crisis risk:

1. Respond to Small Issues Before They Grow

If you see 3+ similar complaints in one day, investigate immediately
Don't let "minor" issues accumulate—they can avalanche

2. Monitor After Product Launches, Ad Campaigns, or Major Announcements

Temporarily increase monitoring frequency to every 5 minutes
Expect elevated volume (recalculate baselines)

3. Have Response Templates Ready

Pre-approved statements for common crisis types
Legal-vetted language for serious issues

4. Train Your Team on Escalation

Everyone should know when to escalate vs handle themselves
Clear ownership: Who responds to what crisis level?

5. Run Crisis Simulations

Test your detection system with fake spikes
Practice response protocols quarterly

Next Steps: Implement This System

Week 1: Set up continuous monitoring

Integrate SociaVault API for mention collection
Deploy monitoring script on a server (runs 24/7)
Calculate baseline metrics from historical data

Week 2: Configure alerts

Set up Slack/email/SMS notifications
Define crisis score thresholds
Test alert system

Week 3: Build response playbook

Document escalation procedures
Create response templates
Train team on crisis protocols

Week 4: Go live with full monitoring

Monitor crisis scores daily
Refine thresholds based on your brand's patterns
Build historical database for trend analysis

Conclusion: The Golden Hour Is Everything

The brands that survive crises are the ones that detect them first.

Manual monitoring is too slow. By the time you manually notice a problem, it's already viral. Automated crisis detection gives you the golden hour—the 60-minute window where you can still contain an issue before it becomes a disaster.

Build this system. Your brand's reputation depends on it.

Ready to implement crisis detection? SociaVault provides the real-time data extraction you need. Try it free: sociavault.com

Social Media Crisis Detection: Catch PR Disasters Before They Explode

What Happens When You Miss a Crisis (Real Examples)

United Airlines "Bumping" Incident (2017)

Peloton "That's Not How This Works" Ad (2019)

Chipotle E.coli Outbreak Response (2015)

The Common Thread: All Were Preventable

The Golden Hour of Crisis Response

What to Monitor: The 5 Crisis Signals

Signal 1: Volume Spikes (Sudden Mention Increases)

Signal 2: Sentiment Shifts (Positive to Negative Ratio Changes)

Signal 3: Negative Keyword Clustering (Crisis Language)

Signal 5: Geographic Clustering (Regional Issues)

Building Your Crisis Detection System

Step 1: Set Up Continuous Monitoring

Step 2: Calculate Baseline Metrics

Step 3: Build the Crisis Scoring Algorithm

Step 4: Set Up Alert Thresholds and Escalation

Step 5: Build Crisis Response Playbook Integration

Complete Crisis Detection System (Production-Ready)

Database Schema for Crisis Tracking

Real-World Case Study: Catching a Crisis in 47 Minutes

Timeline

Best Practices for Crisis Prevention

1. Respond to Small Issues Before They Grow

2. Monitor After Product Launches, Ad Campaigns, or Major Announcements

3. Have Response Templates Ready

4. Train Your Team on Escalation

5. Run Crisis Simulations

Next Steps: Implement This System

Conclusion: The Golden Hour Is Everything

Found this helpful?

Ready to Try SociaVault?

Social Media Crisis Detection: Catch PR Disasters Before They Explode

Social Media Crisis Detection: Catch PR Disasters Before They Explode

What Happens When You Miss a Crisis (Real Examples)

United Airlines "Bumping" Incident (2017)

Peloton "That's Not How This Works" Ad (2019)

Chipotle E.coli Outbreak Response (2015)

The Common Thread: All Were Preventable

The Golden Hour of Crisis Response

What to Monitor: The 5 Crisis Signals

Signal 1: Volume Spikes (Sudden Mention Increases)

Signal 2: Sentiment Shifts (Positive to Negative Ratio Changes)

Signal 3: Negative Keyword Clustering (Crisis Language)

Signal 4: Share Velocity (How Fast Content Spreads)

Signal 5: Geographic Clustering (Regional Issues)

Building Your Crisis Detection System

Step 1: Set Up Continuous Monitoring

Step 2: Calculate Baseline Metrics

Step 3: Build the Crisis Scoring Algorithm

Step 4: Set Up Alert Thresholds and Escalation

Step 5: Build Crisis Response Playbook Integration

Complete Crisis Detection System (Production-Ready)

Database Schema for Crisis Tracking

Real-World Case Study: Catching a Crisis in 47 Minutes

Timeline

Best Practices for Crisis Prevention

1. Respond to Small Issues Before They Grow

2. Monitor After Product Launches, Ad Campaigns, or Major Announcements

3. Have Response Templates Ready

4. Train Your Team on Escalation

5. Run Crisis Simulations

Next Steps: Implement This System

Conclusion: The Golden Hour Is Everything

Found this helpful?

Ready to Try SociaVault?