What Is OSINT (Open-Source Intelligence)? A Security Guide

What is OSINT? Open-source intelligence (OSINT) is intelligence produced by collecting and analyzing publicly or commercially available information to answer a specific question. In cybersecurity, that information includes DNS records, certificate logs, code repositories, job postings, social media and breach notices. Attackers use OSINT for reconnaissance, which MITRE ATT&CK tracks as tactic TA0043, to find exposed systems and plausible phishing pretexts. Defenders and red teams use the same sources to see their organization the way an attacker does, then remove or monitor what they find, within legal and privacy limits such as GDPR.

What Is OSINT?

The U.S. Intelligence Community's IC OSINT Strategy 2024–2026, released by ODNI and the CIA on March 8, 2024, defines OSINT as "intelligence derived exclusively from publicly or commercially available information" that addresses specific intelligence priorities, requirements or gaps. Two parts of that definition matter for security teams.

First, the source must be open: anything a member of the public could lawfully see, request or buy. That includes websites, public records, DNS, certificate logs, internet scan data, social media, news and commercial data sets. It excludes anything that requires breaking into a system, using someone else's credentials or deceiving a person into handing data over.

Second, OSINT is intelligence, not information. A list of 400 subdomains is raw data. "Three of those subdomains run an unpatched VPN appliance, and the IT admin who manages them lists the product on a public profile" is intelligence, because it answers a question someone actually needs answered.

OSINT is one of several intelligence disciplines. ODNI lists it alongside human intelligence (HUMINT), signals intelligence (SIGINT), geospatial intelligence (GEOINT) and measurement and signature intelligence (MASINT). In cybersecurity, it is the discipline most teams can practice without special access.

OSINT vs related terms

Passive vs active OSINT

Passive collection reads sources without touching the target: search engines, certificate logs, archived pages, published filings. The target cannot tell it is happening. Active collection interacts with the target, for example scanning its IP ranges or messaging an employee. ATT&CK keeps these apart: Active Scanning (T1595) and Phishing for Information (T1598) are reconnaissance techniques, but they are not passive OSINT, and in a security test they need explicit written authorization.

The OSINT Intelligence Cycle

OSINT follows the same intelligence cycle that ODNI describes for every intelligence discipline. Its overview of U.S. national intelligence lists six steps: planning and direction, collection, processing and exploitation, analysis and production, dissemination, and evaluation. The table below shows how each step looks in a security exposure assessment.

The planning step does most of the ethical work. A clear question and a written scope stop an assessment from drifting into collecting personal details nobody needs.

OSINT Sources: Where Open-Source Intelligence Comes From

Most security-relevant OSINT comes from a short list of source types. Each one maps to a MITRE ATT&CK reconnaissance technique, which is useful because it tells defenders which of their own exposures an attacker is likely to look at first.

Public records and corporate filings

Company registrations, regulatory filings, court records, procurement notices and press releases show legal entities, subsidiaries, executives, locations and suppliers. Attackers use them to understand business relationships and timing (ATT&CK T1591, Gather Victim Org Information). Acquisitions matter most: an acquired company's domains and systems often stay outside the parent's inventory for months.

DNS, WHOIS and certificate transparency

Domain registrations, DNS records and passive DNS history reveal hostnames, mail providers and hosting choices. Certificate Transparency, specified in RFC 6962 and updated by RFC 9162, requires publicly trusted TLS certificates to be logged in public append-only logs. That is good for security, because domain owners can spot certificates issued for their names, but it also means every hostname on a public certificate is searchable. MITRE describes this as Search Open Technical Databases: Digital Certificates (T1596.003), part of T1596, alongside DNS, WHOIS, CDN and scan data.

Internet scan databases

Search engines for internet-connected devices continuously scan the IPv4 space and index open ports, service banners and certificates. Anyone can query them for an organization's IP ranges. CISA's advisory AA24-038A cites industry reporting that Volt Typhoon used FOFA, Shodan and Censys to search for exposed infrastructure.

Code repositories

Public repositories expose more than code: internal hostnames, employee names, technology choices and, too often, secrets. ATT&CK tracks this as Search Open Websites/Domains: Code Repositories (T1593.003), and its procedure examples include LAPSUS$ searching public repositories for exposed credentials and HAFNIUM finding leaked corporate credentials on GitHub. GitHub reported more than 39 million leaked secrets across its platform in 2024.

A well-documented example: in its September 18, 2023 write-up, Microsoft's Security Response Center explained that an employee had shared a storage URL in a public GitHub repository while contributing open-source AI models. The URL contained an overly permissive SAS token for an internal storage account. Researchers reported it on June 22, 2023, and Microsoft revoked access on June 24. Microsoft said the exposed data included two former employees' workstation backups and internal Teams messages, and that no customer data was exposed. The lesson is that one public link can open a private store.

Social media, job postings and company websites

Professional networks show names, roles, reporting lines and the tools people use. Job postings often name exact products and versions. Company websites, conference talks and press pages add email formats and executive names. These map to T1593 (social media and search engines), T1594 (victim-owned websites) and T1589 (employee names and email addresses). For attackers, this is raw material for pretexts; our guide to what social engineering is explains how those pretexts become phishing, vishing and impersonation attacks.

Breach data, handled ethically

Breach data is the most sensitive OSINT source. ATT&CK notes in T1589.001 that credentials can leak through search engines, breach dumps and code repositories, and that adversaries buy them on criminal markets and Telegram channels that trade infostealer logs. Defenders need to know when their domains appear in a breach, but that does not justify downloading dumps or testing leaked passwords. The ethical standard is in the legal section below. For how investigators and monitoring services find this material, see our overview of dark web search engines.

Public AI services

MITRE added Query Public AI Services (T1682) to the Reconnaissance tactic in 2026. It covers adversaries using public large language models to aggregate and analyze open information, such as researching staff and business relationships to build pretexts. ATT&CK's procedure examples include Kimsuky using LLMs to identify think tanks and experts for spearphishing and APT42 using them to find official email addresses. AI does not create new sources; it makes aggregation faster and cheaper, which raises the value of reducing what is public in the first place.

How Attackers Use OSINT: MITRE ATT&CK Reconnaissance (TA0043)

MITRE ATT&CK defines the Reconnaissance tactic (TA0043) in one line: the adversary is trying to gather information to plan future operations. In Enterprise v20 it contains twelve techniques. Most are passive OSINT; two involve direct interaction with the target.

Each technique ID links to its MITRE page from the list of Reconnaissance techniques. For the framework as a whole, see our MITRE ATT&CK framework explainer.

A real case: Volt Typhoon

CISA, NSA, FBI and partner agencies published advisory AA24-038A on February 7, 2024, about the PRC state-sponsored group Volt Typhoon. Its reconnaissance section maps the group's behavior directly to TA0043. According to the advisory, the actors conducted extensive pre-compromise reconnaissance to learn about the target organization (T1591), its network (T1590) and its staff (T1589), including web searches (T1593) and victim-owned sites (T1594), with a focus on key network and IT administrators. In some intrusions, the agencies observed the actors targeting the personal email of key network and IT staff after compromise.

The advisory adds that the reconnaissance likely helped the actors blend in; in some cases they avoided using compromised credentials outside normal working hours. That is the defender's lesson: what is public about your administrators and your network shapes how quietly an attacker can operate later.

Why reconnaissance is hard to detect

MITRE's own detection notes for these techniques say the activity has a very high false positive rate and often happens outside the target's visibility. You cannot log someone reading your job postings. That is why ATT&CK's mitigation for the whole tactic, Pre-compromise (M1056), focuses on limiting information exposure, monitoring your external attack surface and lookalike domains, and training staff, rather than on detection.

How Defenders Use OSINT: Exposure Assessment and Attack Surface

Defenders use OSINT to answer one question before an attacker does: what can someone outside learn about us, and what could they do with it? In practice, that work splits into three programs.

Exposure assessment. A point-in-time OSINT review run through the intelligence cycle above. It produces a report of exposed assets, leaked secrets, sensitive documents and people-related risk, each with an owner and a fix.

Attack surface management. The continuous version for technical assets: discovering domains, subdomains, IP ranges, cloud resources and services, and flagging changes. Our guide to attack surface management explains how to run it as a program. For U.S. critical infrastructure and state, local, tribal and territorial organizations, CISA's no-cost Cyber Hygiene services scan internet-facing systems for weak configurations and known vulnerabilities.

Brand and identity monitoring. Watching certificate logs and new domain registrations for lookalikes of your brand, plus breach notifications for your domains. Lookalike domains are the setup for phishing and impersonation; our explainer on homoglyph attacks shows how attackers build them from visually similar characters.

A defender's OSINT self-review

1. Write the question and scope. List owned domains, brands, subsidiaries and IP ranges. Exclude employees' personal accounts and family members.
2. Map technical exposure. Pull hostnames from certificate logs and DNS, compare them with the asset inventory, and flag anything unknown or unowned.
3. Check what scan databases show. Look up your own IP ranges and note exposed management interfaces, remote access services and outdated software versions.
4. Search for secrets. Turn on secret scanning with push protection for your organization's repositories and review public repositories that mention your domains.
5. Review people-related exposure. Read your own job postings, staff pages and press material the way an attacker would: which roles, tools and email formats are visible?
6. Check breach exposure safely. Use breach notification services that alert on your domains without handing you the passwords.
7. Report and fix. Give each finding an owner, a fix and a date, then repeat the review each quarter and after acquisitions or major launches.

How Red Teams and Pentesters Use OSINT in Reconnaissance

Red teams and penetration testers use OSINT for the same reason attackers do: it shows where the realistic entry points are. The difference is authorization and purpose. A red team engagement starts with reconnaissance so that the scenario reflects what a real adversary could learn, and its findings go back to the organization so it can remove the exposure.

OSINT feeds three parts of a test:

• External attack paths. Forgotten subdomains, exposed services and leaked keys become candidate entry points, which the testers then validate within scope.
• Social engineering pretexts. Roles, vendors and email formats shape realistic phishing or vishing scenarios. A social engineering penetration test measures how staff respond, and the OSINT shows why a given pretext was believable.
• Exposure findings in their own right. A leaked token or an unowned admin portal is a finding even if the test never uses it.

Rules of engagement for OSINT in a test

Good testers write OSINT limits into the rules of engagement before collection starts:

• Collect only information about the organization and about employees in their professional role.
• Do not research employees' family members, home addresses or personal social accounts.
• Do not log in with credentials found in breach data or repositories; report the exposure instead.
• Do not interact with staff (messages, calls, connection requests) unless social engineering is explicitly in scope.
• Store collected data securely, share it only with named contacts and delete it at the end of the engagement.
• Map each finding to an ATT&CK reconnaissance technique so the report lines up with detection and hardening work.

The report should show what was found, where it was found, why it matters and how to remove or monitor it, without republishing more personal data than the finding needs.

Legal and Ethical Boundaries of OSINT

"Publicly available" does not mean "free to use for any purpose." The legal limits depend on where you are, whose data you collect and what you do with it. This section is general information, not legal advice; check with counsel before running OSINT programs that involve personal data.

GDPR and personal data

Under the EU General Data Protection Regulation (Regulation (EU) 2016/679), personal data is any information relating to an identified or identifiable person, whether or not it is public. Collecting staff names, roles and email addresses for a security assessment is processing personal data, so it needs a lawful basis under Article 6 (security assessments commonly rely on legitimate interests in Article 6(1)(f), which requires a balancing test), must respect the principles in Article 5 such as purpose limitation and data minimization, and triggers transparency duties under Article 14 when data is not collected from the person directly. Article 9 adds stricter rules for special categories such as biometric data.

Enforcement shows that scraping public sources is not a defense on its own. The Dutch Supervisory Authority fined Clearview AI EUR 30.5 million for building a facial recognition database from photos scraped from public websites without a legal basis, processing biometric data and failing transparency duties. The European Data Protection Board's summary lists violations of Articles 5, 6, 9, 12, 14, 15 and 27.

U.S. law

In the United States, the main line is unauthorized access. The Computer Fraud and Abuse Act (18 U.S.C. 1030) prohibits accessing computers without authorization or exceeding authorized access, and the Supreme Court narrowed the meaning of "exceeds authorized access" in Van Buren v. United States (June 3, 2021). Reading a public web page is not hacking; using a leaked password, bypassing a login or scraping against technical blocks can cross the line. State privacy laws also apply to how personal data is collected and used.

The ethical line

For investigators who need a formal standard, the Berkeley Protocol on Digital Open Source Investigations, published by the UN Human Rights Office and UC Berkeley's Human Rights Center, sets out legal and ethical methods for gathering, analyzing and preserving open-source information, including the safety of people who appear in it.

OSINT Tools: Categories, Not a Shopping List

OSINT tools change constantly, so it is more useful to know the categories than to memorize a list. Use any tool only against assets you own or are authorized to assess.

OWASP Amass is an OWASP Foundation project for attack surface mapping and external asset discovery using OSINT and reconnaissance techniques. MITRE's Pre-compromise mitigation (M1056) names SpiderFoot and Recon-ng for finding leaked information and Shodan and Censys for monitoring the external attack surface. GitHub's secret scanning documentation explains how to enable detection and push protection.

How to Reduce Your OSINT Footprint

You cannot delete the internet, but you can remove the details that make an attack cheap and add monitoring for what must stay public.

For the organization

• Own the inventory. Every domain, subdomain, IP range and cloud account needs an owner. Retire DNS records and certificates for services that no longer exist.
• Use private certificates for internal names. Public certificates are logged in Certificate Transparency, so hostnames for internal-only systems belong on certificates from a private CA.
• Keep secrets out of code. Enable push protection, scan history as well as the latest commit, and rotate any leaked key; deleting the commit is not enough, as MITRE's guidance for T1593.003 notes.
• Trim job postings and documents. Describe skills, not exact products and versions, and strip metadata from published files.
• Monitor your brand. Watch certificate logs and new domain registrations for lookalikes, and enforce SPF, DKIM and DMARC on every sending domain.
• Publish a reporting path. A security.txt file (RFC 9116) tells researchers who find your exposures where to report them.

For the people

• Use role-based contacts for public-facing roles instead of personal email addresses.
• Train staff on what attackers harvest and how pretexts start, especially administrators, finance and executive assistants.
• Reduce breach impact with unique passwords, a password manager and phishing-resistant MFA.
• Remove data broker listings for high-risk staff. In California, the state's Delete Request and Opt-out Platform (DROP) has let residents send one deletion request to registered data brokers since January 1, 2026, and brokers have had to process those requests since August 1, 2026.
• Make reporting easy so that a suspicious call or message reaches security quickly.

Re-run the same review each quarter and after mergers, product launches and reorganizations, because each one changes what is public.

Frequently Asked Questions

What is OSINT in simple terms?

OSINT is intelligence built from information anyone can lawfully access, such as websites, public records, DNS and certificate logs, code repositories and social media. It becomes intelligence when it is collected and analyzed to answer a specific question, such as what an attacker could learn about your organization.

Is OSINT legal?

Collecting genuinely public information is generally legal, but how you collect and use it still matters. Accessing systems without authorization, using leaked credentials or ignoring privacy law can make it illegal. In the EU, publicly available personal data is still personal data under GDPR, so it needs a lawful basis and data minimization.

What are examples of OSINT?

Examples include finding an organization's subdomains in certificate logs, spotting an exposed service in an internet scan database, discovering a leaked API key in a public repository, mapping roles from job postings and staff pages, and receiving a breach notification for company email addresses.

What is the difference between OSINT and threat intelligence?

OSINT describes where information comes from: open, public or commercially available sources. Threat intelligence describes what it is about: adversaries, their tools and their campaigns. Threat intelligence often uses OSINT, but it also draws on private telemetry, incident data and vendor feeds.

Is OSINT passive?

Most OSINT is passive, meaning it reads sources without contacting the target. Active steps such as scanning the target's systems or messaging its employees are reconnaissance but not passive OSINT, and in security testing they require explicit written authorization.

What tools are used for OSINT?

Common categories are asset discovery frameworks such as OWASP Amass, automated collectors such as SpiderFoot and Recon-ng, internet scan search engines such as Shodan and Censys, certificate transparency search, link analysis tools such as Maltego, and secret scanners. Use them only on assets you own or are authorized to assess.

Next Step: See What an Attacker Can Learn About You

OSINT is where most attacks start and where many can be stopped. Run the self-review and footprint checklist in this guide, fix the exposures you find, and put monitoring on what has to stay public.

To test whether what is public about your organization is enough for a real adversary to get in, DeepStrike's red teaming services begin with reconnaissance and scoping, model entry through phishing, social engineering and leaked credential reuse, and deliver attacker pathways, evidence and remediation priorities. For the continuous technical side, start with our guide to attack surface management.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• ODNI and CIA: The IC OSINT Strategy 2024–2026 (released March 8, 2024)
• ODNI: U.S. National Intelligence, An Overview (intelligence cycle)
• MITRE ATT&CK: Reconnaissance, Tactic TA0043
• MITRE ATT&CK: Search Open Technical Databases, T1596
• MITRE ATT&CK: Digital Certificates, T1596.003
• MITRE ATT&CK: Search Open Websites/Domains, T1593
• MITRE ATT&CK: Code Repositories, T1593.003
• MITRE ATT&CK: Search Victim-Owned Websites, T1594
• MITRE ATT&CK: Gather Victim Identity Information, T1589
• MITRE ATT&CK: Credentials, T1589.001
• MITRE ATT&CK: Query Public AI Services, T1682
• MITRE ATT&CK: Pre-compromise, Mitigation M1056
• CISA AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (February 7, 2024)
• Microsoft Security Response Center: exposure of internal information due to an overly permissive SAS token (September 18, 2023)
• GitHub: GitHub found 39M secret leaks in 2024 (April 1, 2025)
• GitHub Docs: About secret scanning
• RFC 6962: Certificate Transparency
• RFC 9162: Certificate Transparency Version 2.0
• RFC 9116: A File Format to Aid in Security Vulnerability Disclosure (security.txt)
• EUR-Lex: Regulation (EU) 2016/679 (GDPR)
• EDPB: Dutch Supervisory Authority imposes a fine on Clearview because of illegal data collection for facial recognition (September 3, 2024)
• Cornell LII: 18 U.S. Code 1030, Computer Fraud and Abuse Act
• U.S. Supreme Court: Van Buren v. United States, No. 19-783 (June 3, 2021)
• OHCHR and UC Berkeley Human Rights Center: Berkeley Protocol on Digital Open Source Investigations
• California Privacy Protection Agency: Delete Request and Opt-out Platform (DROP)
• CISA: No-cost cybersecurity services and tools (Cyber Hygiene)
• OWASP Foundation: OWASP Amass