Open source intelligence (OSINT) is the collection and analysis of information from publicly available sources – websites, social networks, public registries, technical databases and leaks – to answer a specific question.
How OSINT works
“Open source” here means publicly accessible, not open-source software. Typical sources include:
- social media and professional networks (LinkedIn, X, Telegram);
- company websites, job postings, press releases and annual reports;
- domain registration (WHOIS), DNS records and certificate transparency logs;
- internet-wide scanners such as Shodan and Censys that show exposed devices;
- code repositories, paste sites and leaked databases;
- satellite imagery, maps, photos and their metadata.
Analysts use tools such as Maltego, SpiderFoot and theHarvester, but the core skill is verification: cross-checking sources and separating facts from noise. Investigative groups like Bellingcat have shown how powerful OSINT can be in journalism.
OSINT in cybersecurity
Attackers use OSINT for reconnaissance: finding employees’ names and email formats for spear phishing and social engineering, discovering forgotten servers, leaked credentials and technologies in use.
Defenders use the same methods to see their organisation through the attacker’s eyes – mapping the external attack surface, monitoring for leaked data and lookalike domains – and as an input to threat intelligence about adversaries and their infrastructure.
Best practices
- Regularly audit what your company and employees reveal publicly.
- Remove unnecessary details from job ads, documents and metadata.
- Respect laws and ethics: OSINT uses public data but must not cross into unauthorised access.
