Social threat correlation

A system comprising:

• one or more processing devices;
• and
• one or more non-transitory computer-readable media coupled to the one or more processing devices having instructions stored thereon which, when executed by the one or more processing devices, cause the one or more processing devices to perform operations comprising:
• scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, a first set of data that is associated with a protected social entity;
• scanning data maintained on one or more additional platforms, wherein scanning comprises identifying, by one or more processors, a second set of data that is associated with the protected social entity;
• wherein, scanning data is performed on a continuous basis, without user initiation;
• determining one or more characteristics of the first set and second set of identified data;
• generating, for each of the one or more characteristics, a reference to the identified data that indicates the characteristic;
• comparing the one or more generated references of the first set of identified data to the one or more generated references of the second set of identified data;
• determining, based on the comparison, a correlation score;
• and
• generating, based on the determined correlation score, a threat level indicator.

A non-transitory computer-readable storage medium encoded with a computer program, the program comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

• scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, a first set of data that is associated with a protected social entity;
• scanning data maintained on one or more additional platforms, wherein scanning comprises identifying, by one or more processors, a second set of data that is associated with the protected social entity;
• wherein, scanning data is performed on a continuous basis, without user initiation;
• determining one or more characteristics of the first set and second set of identified data;
• generating, for each of the one or more characteristics, a reference to the identified data that indicates the characteristic;
• comparing the one or more generated references of the first set of identified data to the one or more generated references of the second set of identified data;
• determining, based on the comparison, a correlation score;
• and
• generating, based on the determined correlation score, a threat level indicator.