Why Online Harm Cross-Pollination is Trust & Safety’s Biggest Blind Spot

Trust & Safety ops weren’t built poorly – they were built for a different era. In the early days of platform governance, splitting operations into dedicated teams for Child Safety, Hate Speech, and Violent Extremism made perfect sense. It satisfied regulatory reporting needs and let specialised analysts focus on clear policy domains, without being pulled across “other risks”.

The challenge is that today’s threat actors don’t respect your internal taxonomies or which moderation queue a ticket sits in.

While platforms often manage risk in isolated operational buckets, a sensible response to scale and reporting obligations, bad actors treat the web as a connected ecosystem. They actively exploit the seams between internal teams, using one harm type as a staging ground, testing vector, or conversation mechanism for another; resulting in harm cross-pollination across your site. 

Category-based moderation doesn’t just produce fragmented queues. It can leave systemic, platform-wide risks unseen until a regulator or the press surfaces them.

The seams in your operations are structural exploits

In most T&S environments, tools, policies, and review queues are configured to catch policy violations in isolation. Inter-team communication is sometimes reactive – happening only after a high-severity escalation hits executive dashboards or triggers external media coverage. That’s a product of how the work is structured, not of any team’s effort.

Threat actors test these operational gaps constantly.

Consider an illustrative campaign trajectory: a threat actor makes initial contact on a self-harm message board, shifts the conversation into violent extremism rhetoric, and eventually coerces the target into financial sextortion. (Those responsible range from organised networks – such as the Com – to young or vulnerable individuals drawn into offending. The exploitation pattern is shared, but the right response differs.) When an incident moves from Queue A to Queue B, critical context gets stripped away. The ticket gets treated as an isolated event, losing its priority level, history, and momentum.

When harms mutate across subject matter boundaries, treating them as individual policy violations merely trims a leaf while leaving the underlying threat network fully intact.

Why point solutions need a network layer

To manage massive scale, platforms rely heavily on point solutions: hash databases for Child Sexual Abuse Material (CSAM), Natural Language Processing (NLP) keyword filters for hate speech, and automated image classifiers for violent content.

These tools are essential and remain the foundation of any safety stack. On their own, though, they can’t see across harm types. Modern threat networks evade static defences easily:

• Evolving obfuscation: shifting to deliberate leetspeak, coded jargon, alt-tech staging areas, and AI-generated media to bypass automated filters
• Harm blending: mixing risk categories intentionally to confuse automated routing logic and slip past queue thresholds
• Network persistence: re-emerging under new burner accounts the moment individual posts or handles are deleted

Used in isolation, point solutions can create a false sense of security. Under systemic risk and duty-of-care regimes such as the EU Digital Services Act (DSA) and the UK Online Safety Act (OSA), platforms are assessed on how well they identify and mitigate risk across their service, not just on what they remove. Missing systematic, cross-pollinated campaigns can therefore expose a platform to severe financial penalties, senior-manager accountability (under the OSA), and serious brand erosion.

Identifying these campaigns means looking beyond post-by-post flags to the network-level connections behind them, ideally before harm reaches the platform.

A complementary approach – Resolver’s outside-in intelligence

Effective threat intelligence requires understanding how bad actors operate against online ecosystems – before, during, and after they touch your platform. Resolver’s outside-in intelligence methodology complements on-platform moderation by pairing OSINT network mapping with seasoned human specialists.

• Holistic threat mapping: instead of waiting for on-platform user reports, we map off-platform actor infrastructure, cross-platform coordination hubs, and emerging tactics across dark web and fringe spaces.
• Behavioural trajectory analysis: we analyse how threat actors shift tactics; tracing the path from initial grooming to extortion or radicalisation, helping you intervene before campaigns hit peak severity.
• Network disruption: using what we map to support the takedown of the infrastructure behind campaigns, not just individual accounts.

Dismantle the silos before the next escalation

Category-based moderation on its own is no longer enough to protect users or satisfy regulators. Winning platforms will be those that connect threat signals across harm types and act on holistic, network-level risk.

Ready to see what your blind spots are?

Rather than learning about blind spots from a regulator or a headline, find them first. Request a tailored Outside-In Risk Assessment with Resolver’s Trust & Safety Threat Intelligence team to identify hidden threat networks operating around your platform. We’ll map the off-platform risk infrastructure targeting your ecosystem and show you how to disrupt cross-pollinated campaigns before they reach on-platform.

See how Resolver helps platforms map harm pathways and understand risk in practice.

About the author: Karley Harper is Head of Trust & Safety Operations at Resolver, formerly Crisp. Spanning an 8 year career in trust & safety investigations, specialising in nuanced online hate speech in European markets and the online manifestation of suicide & self-harm risk, Karley now leads Resolver’s subject matter expertise to proactively mitigate against emerging and persistent risk.