Who's Watching

Things that happened to creators we know (all in the last year):

• A subscriber kept asking about her dog (by name), but she'd never named the dog in a post.
• An ex-partner watched every Instagram story for 9 months from a new account.
• A former contractor started commenting (accurate) revenue numbers under every YouTube short.
• After one Instagram post about voting, 400 strangers showed up in her comments... and none of them had ever interacted with her before.
• A reaction channel turned his worst on-camera moment into a TikTok template and it's been used 40,000 times.
• His YouTube channel got 50 false copyright strikes the week of his course launch (and every account was created that month).
• Her audience kept asking why she was selling NFTs... she wasn't.
• A federal subpoena for her DMs got sent to her platform. She only found out because it showed up in a transparency report.

These might look like eight separate problems, but they're not. They're eight different adversaries, eight different types of threats that you need to be aware of, and proactively protect yourself from.

When something goes wrong, most creators reach for whatever advice and tips they've heard before... "just block them" or "get a P.O. box" or "set boundaries." And none of that advice is wrong, it's just not enough. Because the correct response to a particular situation really depends on what type of threat (or adversary) you're dealing with.

The fan who's been quietly fixating on you for 8 months will probably escalate if you ignore them. The community who's targeted you for harassment will escalate if you respond at all. The ex who already knows your address doesn't care if you use a VPN, and the ideologically-motivated group that was organized to take down your account doesn't care about your block list.

The behavior you're seeing might look similar, but there are different motivation and response engines underneath the surface - and different responses required.

What an "adversary" actually is

In the security world, we use the word adversary to refer to anyone who is an opponent or a threat. But a better definition for how we're using it here is:

An adversary is anyone whose attention to you, your work, or your audience can become a problem - even when they think they're being nice.

Basically, an adversary is anyone who has the potential to become a threat. And that might be a broader definition than you expect, but not everyone who can cause problems is a stalker, even though that's the typical example we think about.

Some adversaries are fans who just got a little too excited. Some are competitors. Some are strangers who just saw an opportunity to make a little cash at your expense. Some might even be governments.

They're all adversaries, but they all want different things from you, are targeting you for different reasons, and the response that works for one might end up making a different one worse.

Why knowing your threat matters

Different motivations create different problems, so even when a situation looks the same on the surface, you need a completely different response to actually handle it.

Take this situation: someone leaves a hostile comment on one of your posts and mentions your kid's school by name.

If that comment is from a fan who's been fixated on you for a while, you want to lock down everything findable about your kid, document the comment, and consider pulling back on the personal content that's feeding the fixation.

If it's from a coordinated group of strangers organized around opposing what you do (or who you are), you reach for platform moderation tools and probably wait it out.

If it's from your ex (or an estranged sibling or former friend who knows the info because they know you in real life), you skip straight to physical safety planning.

These are three different responses to what looks like the same incident. If you pick the wrong response, you might miss where you're most exposed and ignore the tactics that can make you the safest the fastest. Sure, you might want to actually do ALL of these things (especially the one about locking down what's findable), but without knowing what the threat actually is, you risk wasting time, missing the actual exposure, and sometimes making things worse.

Here's what makes each adversary type call for a different response:

• They move at different speeds. An ex-partner with existing access to your life can go from quiet to threatening your physical safety in days because they already have everything they need. A fixated fan might move slower and build for months (sometimes years) before they cross the line. A coordinated ideological campaign can hit overnight but burn out in a week. If you're protecting against the wrong velocity, you either burn through resources too fast or arrive too late.
• Different protections work against different adversaries. Removing your address from public records and data brokers goes a long way against fixated fans or folks who are trying to physically get to you. But it doesn't do a whole lot against an ex-partner (because they already know where you live). It doesn't do anything against the government (they can just subpoena anything they want).
• De-escalation looks different. Ignoring a fixated fan might make things worse if they read that silence as a test. But ignoring a coordinated harassment campaign might be your best bet - because they WANT your engagement (that's the product). Publicly engaging with a competitor who's targeting you might just create more drama. There's no single right move. The right response depends on what's actually driving the behavior.
• Some adversaries can be reasoned with. Some can't. A business competitor might be rational - they're acting in self-interest and self-interest is negotiable. But a fixated fan isn't necessarily reasonable in the first place - they have created a reciprocal relationship where there wasn't one. And ideologically-motivated harassers don't care about your reasoning, because it wasn't about you in the first place - they're just responding to what you represent.

Most creators handle adversaries with whatever random tips they've picked up along the way. And some of those might help you be a little bit safer, but it's not a real strategy, it's duct tape. Real safety starts with figuring out who you're dealing with, then deciding what to do about it.

Two questions to figure out who you're dealing with

There are two questions that will get you most of the way to identifying which type of adversary you're dealing with.

1: How much is this actually about you?

One one end of the spectrum, you're a specific person and the adversary cares about YOU. They know what you look like or what you sound like. They have feelings about you, whether that's closeness, grievance, possessiveness, and those feelings are directed at you, personally. If you stopped being a creator tomorrow, they'd still have those feelings.

On the other end, you're interchangeable. They don't care who you are. They care about what you have (an audience, a brand, money) or what you represent (an identity, an ideology, a category, a position). If you stopped being a creator tomorrow, they'd just move on to someone else.

2: How known are they?

Is this someone you actually know? Sometimes there's a real relationship there - a former partner, collaborator, family member. They have your phone number because you gave it to them.

On the other hand, they could be a complete stranger. You've never met them... they might not even know your real name. Whatever they know about you came from your content or from research.

Every adversary fits somewhere on these two questions and where they sit tells you a lot about how to react to that threat.

When we look at the different types of adversaries on a map, you can see that, while we mostly think about creator threats as fans who turn into stalkers (that's The Attached), most of the adversary types are actually strangers who mostly care about what you represent, not about you personally.

The 2x2 grid here is a useful starting point, but we need more than two dimensions to actually be useful in practice. So we built a second view that adds what they want and what kind of relationship they think they have with you.

This radial view organizes the same 8 adversary types by motivation (the labels on the outer ring) and relationship (which ring they sit on). The slices answer the "why" they're targeting you. The rings answer "how close" they are to you. And the little icons above each label tell you whether you're typically dealing with an individual, a group dynamic or an institution.

Now, let's dig into each archetype.

The stranger who feels like they know you

The Attached

The fan who crossed the line

The Attached started where you wanted them to start on your customer journey. They were a stranger, became aware of you, then they became part of your audience, maybe even a fan. Each step of that progression was intentional - it's what your creator business is designed to produce... fans. The Attached just kept going past your intended customer journey.

They genuinely believe they have a relationship with you, and the more personal, direct, or intimate your content is, the stronger that belief can get. They normally don't think they're doing anything wrong... they genuinely think the relationship is mutual.

What it looks like: comments or likes on your posts within minutes of publishing, DMs that assume familiarity (referencing pets or kids names, or stuff you mentioned months ago), showing up on all your platforms even if you might only be active on one. Maybe visible hurt or hostility when you don't acknowledge them. Sometimes it can progress to gifts, letters, contact attempts outside public channels, contacting your family or friends.

What tends to help:

• Saying no clearly and consistently every time
• Keeping records of every contact
• Pulling back on the kind of content that's feeding the parasocial connection
• Blocking them across every channel they use, at the same time

What tends to backfire:

• Ignoring them (they often read silence as a test)
• Engaging emotionally (even hostile engagement can reinforce the perceived relationship)
• Publicly addressing it (they're likely to interpret that as you thinking about them)

This is the type of adversary who is most likely to be genuinely delusional about the relationship, so rational engagement ("I don't know you, please stop") might not register the way it would with a rational stranger.

The hard truth here is that at a certain audience size, you probably have at least one Attached fan in your audience right now. Most of them will never cross The Line. But the question isn't whether you have an Attached fan - at scale, you do - it's whether your protections exist before one of them decides to act.

The strangers activated by your content or identity

The Believers

They hate what you stand for

The Believers don't watch your content - because they don't need to. Your identity or your position is enough. The Believers are ideologically motivated. They aren't necessarily targeting YOU as a person, they're targeting you because of what you represent, whether that's an idea, an identity or a position they oppose. You're a symbol, not an individual. You just happen to be a version of the thing that they can actually reach.

That's what makes them uniquely resistant to personal engagement - you can't actually de-escalate someone who isn't mad at YOU. They're mad at what you represent.

There's a distinction with Believers that matters → content-activated vs identity-activated. Content-activated Believers are triggered by your positions, so if you changed your content, they'd probably stop targeting you. Identity-activated Believers are triggered by who you ARE - and no content change can address it because your existence is the trigger.

Identity-activated targeting is both more persistent and more personal in practice - and a lot harder to manage. A trans creator making cooking videos is likely going to face identity-activated Believers regardless of what she's talking about.

This matters because it tells you whether protecting yourself by adjusting your content is even an option. For content-activated Believers, sometimes changing your content is an option that can help. But for identity-activated Believers, it's really not - because there's nothing to adjust.

What it looks like: hostile engagement that references ideology instead of content specifics ("you people are destroying society" vs "I disagree with your take"). Coordinated campaigns like multiple accounts using similar language around the same timeframe. Organizing happening in places you can't see (subreddits, Discord servers, group chats). Mass reporting designed to get the platforms to take action against you, maybe even contact with your sponsors.

What tends to help:

• Having your platform security set up before you post anything that might trigger them (2FA on, comment filters set up, DMs restricted).
• Moderation tools that can absorb the initial wave
• Making yourself harder to find online (home address, family info, the obvious stuff - so the targeting stays online)
• Sometimes just waiting it out, because these types of campaigns often burn hot and then move on

What tends to backfire:

• Engaging with the ideology while you're under attack (that can become just more content for the campaign)
• Counting on the platforms to step in
• Going dark

The key thing to remember about The Believers - they care about the representation, not the person. So, they often move on when a more visible target shows up.

The Crowd

Your reaction is their content

The Crowd doesn't care what you said. They don't care who you are. They care how you react - because your reaction is their content.

Many of the other adversary archetypes have a relationship with you of some kind - parasocial, ideological, professional, personal, financial - but The Crowd only has a relationship with their own community. You're a prop, your distress is their content and your clap back... that's even better content.

This is the scenario where "don't feed the trolls" is directionally right, but a little oversimplified. The Crowd doesn't escalate because they're angry - they escalate because your reaction is the whole point. They're the hardest archetype to predict in advance because who they decide to target depends on what their community is into that week - it has nothing to do with you (or probably even your content). A single viral moment can make any creator a target regardless of their usual content.

What it looks like: engagement designed to get a reaction out of you, not to make a point. Signs of coordination (similar phrasing across accounts, same timing). Evidence that your reactions are getting shared in other communities (like forums, Discords, subreddits). Targeting that keeps going regardless of what you post or do. "Commentary" content about you on other people's channels.

What tends to help:

• Deny them content - almost any response becomes content for them
• Being boring as a target is usually the most effective move
• Keeping an eye on the community where they're organizing is usually more useful than watching your own platforms

What tends to backfire:

• Engaging in any way
• Just reporting them on the platform

The Crowd is the only type where your reactions are what creates the risk - not your content choices, so your best bet is to adjust your responses... not your work.

Strangers activated by what you've built

The Rival

They want what you have

The Rival isn't a fan who went sideways or someone on an ideological crusade. They're someone in your professional world who figured out that using the platforms against you is cheaper than competing on merit.

They target you because you're in the same niche, going after the same audience, or chasing the same revenue. But the goal isn't to hurt you personally, it's to win a position in the market. The Rival is the most strategic (and maybe least emotional) adversary.

But that also makes them predictable. The Rival's behavior normally lines up with competitive moments - think launches, sponsorship announcements, viral moments, growth milestones.

What it looks like: coordinated mass reporting campaigns timed around launches. Content theft, IP infringement, SEO attacks. Fake negative engagement (bought comments, review bombing). Contacting your sponsors with negative info about you. Impersonation accounts designed to confuse your audience about who's real. Buying followers to mess with your sponsorship metrics.

What tends to help:

• Save everything (screenshots with timestamps, copies of takedown notices, all the receipts)
• Building actual relationships with folks at the platforms, so you have direct contacts when the fake reports start hitting.
• Protecting your IP (trademarks, DMCA tools)
• Knowing other creators in your niche who can confirm what you're seeing
• Getting lawyers involved if it becomes ongoing IP theft or sabotage

What tends to backfire:

• Retaliating (tends to become a war that damages both brands)
• Public callouts without receipts
• Assuming platforms will sort it out

The Rival is the type most likely to stop on their own once the competition passes. Hold the line, document everything, enforce your legal rights, and they'll often fade.

The Opportunist

They want what your visibility is worth

The Opportunist has probably never watched a single one of your videos. They don't care about your message. They look at your audience, your brand, your reach and they see... money.

The Opportunist is all about using your visibility to make money for them. So, impersonation, scams using your likeness, unauthorized merchandise, phishing campaigns aimed at your audience. You're a resource to extract from, not a person to engage with.

This type of threat might actually be completely invisible to you because they're not interacting with you at all. The damage to your audience and your brand can happen without your knowledge at all. A lot of creators have Opportunists going after them right now and they have no idea.

What it looks like: fake social media accounts using your name, likeness or branding. Unauthorized merch, courses, or products with your brand on them. Phishing campaigns aimed at your audience. Affiliate fraud. Domain squatting on variations of your name. AI-generated content using your voice or face. Audience members reporting "weird DMs" that supposedly came from you.

What tends to help:

• Regularly checking for impersonation accounts (or paying someone to)
• Registering your trademarks and your brand
• Teaching your audience what real messages from you actually look like
• Getting verified on platforms where you can
• Reporting and getting fake accounts taken down quickly

What tends to backfire:

• Expecting them to engage with you
• Relying on your audience to self-police
• Assuming small-scale impersonation is harmless (it erodes audience trust whether you see it or not)

The Opportunist is not likely to physically target you (because they don't care about you personally). But they're also the one that most standard cybersecurity advice was actually built for (and it works, so lock down those accounts!)

The State

The government doesn't need to stalk you - it can just subpoena you

The State is government or institutions using their power - subpoenas, surveillance, legal pressure, law enforcement actions - to target creators. The State doesn't follow the rules of regular individual adversary behavior because it doesn't have to. The government has tools that skip past individuals entirely.

A stalker has to find your address. The Believers have to find your name. But the government can just walk up to a platform and demand both (and the platform will hand it over).

The State is the most context dependent adversary on this list. What it takes to get on their radar changes dramatically depending on the political environment. Two years ago, most US creators didn't need to worry about this. Today, creators making political content, covering activism, doing investigative work, or creating identity-forward content are actually at risk. That's been true for creators in other countries for a long time, but is relatively recent here.

What it looks like: Government or law enforcement contact (subpoenas, "friendly" outreach). Platform restrictions that don't match any content policy. Coordinated pressure on your advertisers from government sources. Legal actions designed to reveal your identity. Patterns of enforcement disproportionately hitting creators with similar political content.

What tends to help:

• Keeping your legal identity separate from your platform identity
• Using platforms that publish transparency reports about government requests
• End-to-end encryption for sensitive communications
• Having a lawyer lined up before you need one
• Press freedom and digital rights orgs (EFF, ACLU, Committee to Protect Journalists, PEN America)
• Being on more than one platform

What tends to backfire:

• Assuming the protections of the past will hold
• Standard personal security on its own (address protection doesn't help against a subpoena)
• Assuming you're "too small to matter"

The State is the only adversary with legal authority and the protections that work against the other types are important, but they're not sufficient. Governments have access to tools and power that are legitimately difficult to fight against.

The people who actually know you

The Burned

The professional relationship that went bad

The Burned used to have your passwords, they know your real numbers... and now they have a grudge.

This is probably someone you used to work with (a collaborator, employee, contractor, business partner, client, etc.), who has both a grievance and insider info. They have real information, real prior access, and real resentment. And that combo lets them do damage quickly and specifically.

Most creators don't think about this type of threat until it happens. The professional relationship ended badly, you didn't remove access or change shared passwords and now they're using that access against you.

What it looks like: public criticism that references insider knowledge (revenue numbers, private convos, strategic decisions). Contact with your current collaborators or sponsors, using insider info as leverage. Threats to expose private business info. Unauthorized use of shared accounts, documents, systems. Social media campaigns built on insider knowledge. Timing that lines up with specific events (a firing, contract dispute).

What tends to help:

• Change all shared passwords and remove access the moment the professional relationship ends
• Building separation agreements into every collaboration before you need them
• Having a lawyer review your separation terms before things turn adversarial
• Keeping records of professional communication throughout the relationship

What tends to backfire:

• Assuming the relationship will end cleanly
• Just making yourself harder to find online
• Trying to fix the grievance after they've started coming after you

The Burned mostly goes after your reputation and your revenue. But they're not the only adversary that actually knows you.

The Familiar

The person who already has your keys

The Familiar is someone who doesn't need to find your home address, they already have a key. They don't need to hack your accounts because they already know your passwords.

When it comes to physical safety, the most dangerous adversary isn't a stranger - it's the person who was already inside. The Familiar is a current or former intimate partner, family member, or close personal contact who turns your public presence into leverage in a personal conflict. This is where domestic threats and public personas collide, and traditional security frameworks handle that combo really poorly because they treat "online threats" and "domestic threats" as totally separate categories, but for creators, they can be the same thing.

Here's what makes The Familiar fundamentally different from every other adversary type on this list... every other adversary cares about you because you're a creator. The Believers care because you have a platform. The Opportunist cares because you have a brand. The Crowd cares because you have an audience. But The Familiar would target you whether you were a creator or not. Your visibility just gives them more avenues to attack you. They can use your audience, your platform and your public presence as leverage.

What it looks like: Threats to expose private info to your audience. Obsessively watching your content. Using knowledge of your schedule and your location. Contacting your audience, collaborators, sponsors, etc. with personal info about you. Using shared accounts or financial systems. Going after your kids, personal relationships, or mutual friends. Things getting worse during transitions (breakups, divorces, custody disputes).

What tends to help:

• Locking down all your devices and accounts immediately when the relationship ends
• Checking your physical security if they've ever had a key (or knew where you hid the spare)
• Saving every threatening message for legal action
• Working with domestic violence/stalking specialists when it escalates to that point
• Reaching out to people they might contact so they're not caught off guard

What tends to backfire:

• Standard online safety advice (it assumes a stranger needs to find you - but The Familiar already knows)
• Just blocking them on platforms
• Assuming your public platform isn't relevant to a "private" conflict.

The Familiar is the highest immediate physical safety risk of any adversary type. Every other type requires them to escalate to physically get to you, but The Familiar starts with that info in hand.

The research is consistent that closer prior relationships lead to more severe stalking outcomes, not less. The intuition that "someone I know wouldn't go that far" is the opposite of what the data shows. And, as creators, we often forget that our real life and our digital life can cross paths.

What to do with this

That was a lot of deep-dive info, but here's the practical way we use this framework in our work (and how you can too):

• Figure out who you're dealing with before you act. When something happens, the first question shouldn't be "what do I do?", it should be "who is this?". Different engines and motivations need different responses, so figure out who and what you actually need to protect yourself from before you act.
• Know which types apply to you in general, before an incident. Your content, your identity, your platform and your relationship history can all help predict which adversaries are most likely to target you. A nonbinary political commentator faces a different threat landscape than a parenting blogger. A creator who sells courses faces a different threat landscape than one who sells sponsorships. The adversary types that apply to YOU can point you in the right direction of what types of protection strategies make the most sense for you to focus on. If you're not sure about which types apply to you, you can take our free Creator Risk Profile to get your specific risk landscape and some initial protection actions to start with.
• Pay attention to the relational archetypes - The Burned and The Familiar - when transitions happen. Most creators only think about these types after they're activated. But the cost of proactively changing passwords and access when a professional or personal relationship ends is pretty small and the cost of skipping it can be severe.
• Understand that your profile keeps changing. Growing audiences, new content directions, life changes, shifting political environments, platform changes... all of these change your risk profile. That's why we recommend you get an updated risk assessment about every 6 months or so.

This framework is a diagnostic tool - it's not supposed to be a paranoia generator. Most people in your audience are there because they value your work. Most collaborators are just people you work with. Most people in your public life aren't threats.

We designed this framework to give you a way to think clearly in moments when clear thinking is hard - and to give you a direction to start thinking about the best, most effective ways to protect yourself.

The protection work that goes into being able to show up safely requires steady, consistent effort. You're not going to get it all done in a day. So, using this framework to understand who your most likely threats are - and to proactively take actions to help you protect against the most likely threats gives you the most protection the fastest. But once you've protected against your most likely threats... it's time to work on protecting against the rest of them. Because just because one archetype is likely to be the threat, doesn't mean the other potential threats don't exist.