Symantec wanted to drive awareness of threats featured in its Internet Security Threat Report. Prime among the featured threats were Trojan attacks. We drove awareness of this threat through the first use of Twitter's image preview limitation as a storytelling device.

Until December 2015, only a limited portion of each Twitter image was visible in preview, and an additional click was required to view the full image. At a time when every user and brand on Twitter treated this as a limitation and a necessary evil, we turned it into a two-step device to tell a story of a security threat and its solution.

The image was carefully illustrated to trigger Twitter's algorithm that previewed the most visually dominant element. The image preview (visible in the Twitter feed) represented the threat of Trojans, and the full picture (visible upon expanding) represented Symantec's ability to solve this threat.

We illustrated a social post that was a bait-and-switch story, much like a Trojan itself. The image preview showed a Trojan horse attacking a city in a medieval setting. Upon clicking to expand to the full image, it was revealed that the Trojan was nothing more than a child's toy, and the medieval setting was nothing more than a play area of two children poised to quell the threat of the toy Trojan. This represented Symantec's ability to reduce threats to a manageable scale and solve them.

Achieving the right illustration required multiple iterations and testing to assess how Twitter's algorithm previewed the image. Considering that Twitter previewed the visually most dominant element, we had to constantly tweak shapes and colours of objects to ensure that the previewed element created an effective mislead and did not give away the punchline.

In our first few tests, the top third of the image was previewed, which was clearly wrong as it gave away the punchline. Through trial-and-error, we made the central portions more pronounced in their shapes, line work and colours to ensure that the central portion was previewed.

Another consideration was the exact boundaries of the preview area. This determined our exact line work in the boundary areas, so that there was no visual element that gave away the reveal in the preview.

The post was placed on the Symantec Asia Twitter page that has over 8,000 followers (over 4,000 followers at that time). It received 166 retweets and 262 likes, 8 times more than any other Symantec tweet worldwide in 2015.