What OSINT Actually Is (and Isn't)
Open-source intelligence — OSINT — is one of the most misused terms in security. Depending on who’s talking, it means anything from “I googled someone” to nation-state collection programs. This primer pins the term down so the rest of our research has a shared vocabulary.
The definition that actually works
OSINT is intelligence produced from publicly available information — information that anyone can lawfully obtain by request, purchase, or observation. Three parts of that sentence carry weight:
- Publicly available — no hacking, no credentials you weren’t given, no pretexting your way past access controls. If obtaining the data breaks a law or a term of access, it isn’t “open source” anymore.
- Produced — raw data isn’t intelligence. A pile of screenshots is collection; intelligence is what you get after verification, analysis, and putting findings in context for a decision.
- Intelligence — it answers a question someone actually asked. Collection without a requirement is just hoarding.
Rule of thumb: if you can’t articulate the question you’re answering and the lawful basis for looking, stop before you start.
What counts as an open source
More than most people expect:
| Category | Examples |
|---|---|
| Web content | Websites, blogs, forums, paste sites |
| Social media | Public posts, profiles, follower graphs |
| Public records | Corporate registries, court filings, property records |
| Technical data | DNS records, TLS certificates, WHOIS, BGP announcements |
| Media | News archives, satellite imagery, street-level photos |
| Grey literature | Conference papers, tenders, job postings |
Job postings alone are a masterclass: a company advertising for “SOC analysts with Splunk and CrowdStrike experience” just published part of its security stack.
The cycle, compressed
Serious OSINT work follows the intelligence cycle, even informally:
- Requirement — define the question (“What does our company expose that an attacker could use?”).
- Collection — gather from sources you can lawfully access, recording where each item came from.
- Processing — normalize, translate, deduplicate.
- Analysis — verify independently, weigh reliability, resolve contradictions.
- Dissemination — report findings to whoever asked, with confidence levels.
Skipping straight from collection to conclusions is how misidentifications happen — including the infamous internet-mob cases where “OSINT” named the wrong person entirely.
What OSINT isn’t
- It isn’t hacking. The moment you authenticate somewhere you shouldn’t, you’ve left OSINT for computer misuse.
- It isn’t automatically ethical because it’s legal. Aggregating public data about a private individual can be lawful and still be surveillance. Purpose matters.
- It isn’t verification-free. A screenshot is a claim, not a fact. Every finding needs a second, independent source before it’s reported.
Why defenders should care
Everything an attacker learns about you in their reconnaissance phase comes from the same open sources you can check yourself. Running OSINT against your own organization — your domains, your staff’s public footprint, your leaked-credential exposure — is the cheapest security assessment you will ever do. That self-assessment workflow is exactly what we cover in Map Your Own Digital Footprint.