Traditional advisory models focus on events—policy changes, financial disclosures, competitive moves. But in contested industries, those events are often preceded by coordinated narrative activity that shapes how they will be received. For strategy and advisory firms, this creates a critical blind spot.

Clients are asking:

• Why is this happening?
• What does it mean for us?
• What should we do next?

But increasingly, the better question is: Who is shaping this perception—and to what end?

Firms that can answer that question move beyond reporting into true strategic interpretation.

This is where narrative intelligence changes the value proposition:

• From explaining events → to anticipating them
• From tracking competitors → to decoding influence
• From reactive guidance → to decision advantage

Signals of the Strait of Hormuz closure were visible in the information environment weeks before the disruption reached Western headlines — or any supply chain risk dashboard.

By the time most organizations recognized the crisis, the narrative driving it had already formed, spread, and begun moving markets. Insurance premiums were rising. Shipping routes were being reconsidered. Commodity traders were already pricing in uncertainty.

This report examines how Iranian state messaging around the Strait of Hormuz functions as a measurable precursor to supply chain disruption — and what those signals looked like before the crisis became a crisis.

It covers the four narrative themes Iran deployed to shape global perceptions of the Strait, how that messaging amplified through state media, social networks, and Western outlets, and what supply chain risk teams can monitor to detect similar escalation patterns earlier.

The window to act proactively is always open before the narrative matures. This report shows what it looks like before it closes.

This report examines the coordinated Russian Matryoshka bot network malign influence campaign of February 2026. It combines cross-platform narrative analysis, network amplification mapping, and visual-content forensics.

Russian information operations increasingly rely on AI and leverage large networks of inauthentic social media accounts, synthetic media, and coordinated cross-platform amplification. High-profile scandals - such as the crimes of Jeffrey Epstein—are frequently repurposed to discredit Western political leaders.

The Matryoshka operation demonstrates the growing sophistication of Russian influence operations. These campaigns integrate bot networks, fabricated media artifacts, and synchronized cross-platform dissemination, using emotionally charged scandals to support geopolitical messaging.

The Narrative Escalation of a Healthcare Ransomware Breach examines how a technical cybersecurity vulnerability evolved into a full-scale institutional crisis narrative.

The report analyzes the exploitation of a critical flaw in BeyondTrust remote-access software and the resulting ransomware incident affecting the University of Mississippi Medical Center.

The case illustrates how modern cyber incidents unfold across two distinct narrative tracks. The first emerges within specialized cybersecurity communities as vulnerabilities are disclosed, exploitation risks are analyzed, and patch advisories circulate among security professionals. The second begins once operational disruption becomes public, shifting coverage toward institutional impact, healthcare service interruptions, and broader concerns about cybersecurity resilience.

Together, these narratives demonstrate how vulnerability disclosures can rapidly escalate into operational, reputational, and strategic challenges for organizations in critical sectors such as healthcare.

This report analyzes how Iraq became an active front in the US Israeli war with Iran after US forces struck Iran backed militia Kata’ib Hezbollah on 28 February. The strike prompted retaliatory attacks while Iraq’s political parties remain unable to form a government.

EdgeTheory’s narrative intelligence detects escalation signals and rising narrative volume tied to militia retaliation and regional reactions following the strikes on Iran.

These indicators point to deepening instability that could further destabilize Iraq’s Shi’a dominated political system.

This report analyzes the 3 January 2024 bombing in Kerman as both a mass-casualty attack and a catalytic information event. It integrates geospatial indicators, narrative attribution patterns, and cross-platform information flows to assess how competing actors shaped and contested meaning in the aftermath across regional and transnational audiences.

On 3 January 2024, twin bombings near the grave of Qasem Soleimani in Kerman killed more than 90 people during a mass commemoration ceremony marking the fourth anniversary of his death in a U.S. drone strike. The attack was later claimed by Islamic State-Khorasan Province (ISIS-K), triggering an immediate information contest over attribution and strategic meaning.

The event illustrates how violent incidents function as both operational acts and narrative inflection points. ISIS-K framed the bombing as a sectarian strike against a Shi’a ritual gathering, while Iranian authorities embedded the event within their “axis of resistance” narrative and broader confrontation with Israel and the United States.