The Poster’s Threat Matrix
In eleven years of analyzing online incidents, the single most consistent finding is this: the poster did not think the post was risky.
This is not a failure of intelligence. It is a failure of risk assessment. Most people have no framework for evaluating the danger of a post before they publish it. They rely on instinct, and instinct is unreliable.
The following threat matrix was developed from a dataset of 2,400 documented incidents. Each threat level corresponds to observed outcomes. The classifications are empirical, not theoretical.
Classification System
We use a five-level system modeled on standardized threat assessment protocols. Each level reflects the statistical probability of a post generating negative engagement that exceeds the poster’s capacity to manage it.
GREEN — Negligible Risk
Probability of incident: < 2%
Posts in this category have virtually no history of generating negative outcomes in our dataset. They are structurally inert. Examples:
- Posting a photo of a sunset without commentary
- Wishing someone happy birthday
- Saying you liked a widely liked movie
- Sharing that you are eating lunch
- A photo of your pet doing nothing unusual
Analysis: GREEN-level posts fail to provide engagement leverage. There is nothing to quote-tweet. Nothing to disagree with. Nothing to screenshot. The post exists, is acknowledged by a small number of people, and disappears into the feed without consequence.
Field Note: The safest post is the one nobody feels compelled to respond to. This is also, by definition, the least engaging post. The relationship between safety and engagement is inversely proportional. This is the fundamental tension of posting.
YELLOW — Elevated Risk
Probability of incident: 5–15%
Posts in this category are generally safe but contain structural elements that can, under specific conditions, attract unwanted attention. Examples:
- A food opinion delivered with mild confidence (“Pineapple on pizza is fine”)
- Rating or ranking things (“My top 5 movies of the decade”)
- Casual observations about a city, region, or profession
- Mild self-deprecation that could be read as a humble brag
- Any post that includes the word “overrated”
Analysis: YELLOW-level posts become dangerous primarily through audience mismatch. In a controlled environment—among followers who share context with the poster—these posts resolve without incident. The risk emerges when the post escapes its intended audience, which occurs through retweets, quote tweets, or algorithmic amplification.
Contributing factors to escalation:
- The poster has more than 5,000 followers (increases audience volatility)
- The post is published during peak hours (10 AM–2 PM EST)
- The topic overlaps with an active discourse cycle
Field Note: “Overrated” is a YELLOW-level word on its own. Combined with a proper noun, it becomes ORANGE.
ORANGE — High Risk
Probability of incident: 15–40%
Posts in this category have a meaningful probability of generating negative engagement. They contain structural vulnerabilities that experienced posters can identify but casual posters typically miss. Examples:
- Discussing your salary, rent, or cost of living in specific terms
- Commentary on other people’s parenting decisions
- Any sentence beginning with “I’m sorry but”
- Posting about a topic you have casual familiarity with but not expertise in
- Describing a personal habit you believe is universal but is not
- Asking “Am I the only one who…?” (the answer is always no, and the responses will be hostile)
Analysis: ORANGE-level posts share a common feature: they expose a gap between the poster’s self-perception and how they are perceived by a broader audience. The poster believes they are sharing a relatable observation. The audience perceives them as out of touch, presumptuous, or oblivious.
This gap is the single most reliable predictor of incident severity. The wider the gap, the worse the outcome.
Escalation pathway: ORANGE-level posts typically escalate when a quote tweet reframes the original post to highlight the gap. For example, a post about “struggling to find a good cleaner” may be intended as a mundane complaint but is received as a display of economic disconnect. The poster is rarely aware of the reframing until the notifications arrive.
Field Note: Posts beginning with “I’m sorry but” have a 34% incident rate in our dataset. The phrase functions as a signal that the poster knows the take is bad but has decided to post it anyway. The audience responds accordingly.
RED — Critical Risk
Probability of incident: 40–75%
Posts in this category will, more often than not, generate a negative outcome. The poster has entered a high-risk environment and is unlikely to emerge unscathed. Examples:
- Doubling down on a post that is already receiving pushback
- Posting a thread explaining why you were actually right
- The self-quote tweet (“Since people are misunderstanding my earlier post…”)
- Correcting someone who has more expertise than you, publicly
- Making a joke about a topic currently in the news cycle’s active grief window
- Any post that begins with “Nobody is talking about…”
Analysis: RED-level posts are distinguished by a common psychological state: the poster believes they are correcting a misunderstanding when they are, in fact, escalating a conflict. The follow-up post, the clarification thread, the self-quote—all of these are attempts to regain control of a narrative that has already left the poster’s hands.
Our data is unambiguous on this point: clarification posts make things worse in 78% of observed cases. They provide fresh material, reopen decaying news cycles, and signal to the audience that the poster is rattled—which increases engagement.
Critical escalation indicators:
- The post references the number of replies or quote tweets it has received
- The poster addresses “everyone” as if speaking to a crowd
- The phrase “let me be clear” appears
- The poster begins litigating the replies individually
Field Note: “Since people are misunderstanding” is, in functional terms, a request for more people to misunderstand you. It has never, in our dataset, resulted in fewer people misunderstanding you.
BLACK — Unsurvivable
Probability of incident: > 75%
Posts in this category have no safe outcome. The poster has entered a terminal escalation state. In our eleven years of data collection, we have not documented a single case of a BLACK-level post resolving favorably for the poster. Examples:
- Telling people they are “mad” or “triggered” when they are clearly neither
- “You’re all proving my point”
- Engaging in a public argument with someone who has 50x or more your follower count
- Posting “I’m not going to apologize for having an opinion” in response to criticism
- The word “ratio” used defensively (“You can’t ratio me if I don’t care”)
- Threatening to leave the platform (and then not leaving)
- Posting “this is my last tweet about this” (it will not be your last tweet about this)
Analysis: BLACK-level posts share a terminal characteristic: the poster has confused the act of posting with the act of winning. They believe that continued engagement demonstrates strength. In reality, it demonstrates that the poster has lost perspective on the scale of what is happening around them.
The “you’re all proving my point” defense is the most studied example in our database. Across 312 documented uses, it has resulted in a favorable outcome zero times. It functions as an accelerant: it enrages people who were mildly annoyed, engages people who had moved on, and provides a clean, screenshot-ready summary of why the poster is being mocked.
Field Note: “I’m not going to apologize for having an opinion” is technically true in every case we’ve observed. The poster does not apologize. The situation does not improve.
Using This Framework
The Poster’s Threat Matrix is a diagnostic tool, not a content strategy. We do not advise posting exclusively at the GREEN level. GREEN-level posts are safe precisely because they are unremarkable. A timeline composed entirely of GREEN-level posts is, in functional terms, not a timeline at all.
The purpose of this framework is awareness. Before posting, consider:
- What level does this post occupy? Be honest. The most common error is classifying your own posts one level lower than they actually are.
- Am I prepared for the outcome associated with this level? YELLOW- and ORANGE-level posts can be worth the risk. RED-level posts rarely are.
- What is my exit strategy if this escalates? If the answer is “I’ll explain what I meant,” review the RED-level data above.
- Have I posted recently about this topic? Multiple posts on the same subject within a short window compound risk. Each subsequent post is classified one level higher than it would be in isolation.
A Note on False Security
The most dangerous conclusion a reader can draw from this framework is “I now know how to post safely.” Risk assessment reduces the probability of incidents. It does not eliminate them. Our dataset contains numerous examples of objectively GREEN-level posts that, through algorithmic anomaly or contextual bad luck, escalated to Tier 3 or above.
The only post with a 0% incident rate is the one you don’t publish.
We present this not as a recommendation, but as a finding.
Want to see these dynamics in action? Our forensic timeline reconstructs a main character moment phase by phase.
Think you might be at risk right now? Take the How Owned Are You? assessment for a current threat evaluation.