OSINT in plain English
In this context, “open source” doesn’t mean free software but open sources: anything that can be accessed without breaking in or entering a password. “Intelligence” is meant in the sense of reconnaissance. OSINT, then, means assembling many public puzzle pieces into a meaningful overall picture.
Think of a burglar who watches a house for days: When is nobody home? Which window is often left open? When does the delivery driver come? Online, it’s even easier – and it happens completely under the radar. The attacker behaves like an ordinary visitor or doesn’t access your systems at all – which is why you don’t notice a thing.
Each individual piece of information seems harmless. Only in combination does it become valuable – for attackers as well as for you. You can find out how such an investigation works for businesses on our OSINT Assessment page.
How OSINT works
OSINT research usually follows a set process:
- Define the objective: What should be uncovered – for example, reachable systems, contact persons, or leaked credentials?
- Analyze sources: Typical sources include the company website, social and professional networks, job postings, the commercial register, and search engines. DNS records – a kind of phone book for the internet – and public directories of website security certificates are technically revealing. They often expose subdomains, for example for a test portal. Metadata also provides clues: hidden extra information in published documents, such as usernames or software versions.
- Connect the dots: The findings are brought together. For example, names from networking profiles combined with the format of a known email address can be used to derive the addresses of many employees.
- Assess: Which information is useful for an attack, and which is harmless?
OSINT is predominantly passive: no systems are attacked and no passwords are tried. However, anyone who collects personal data must comply with data protection law even when the information is publicly accessible. Reputable assessments therefore work with a clear mandate and follow the principle of data minimization.
A practical example
A logistics company posts a job ad for a system administrator and names the vendor and product of its firewall and its VPN solution. On a professional networking site, many employees openly list their role at the company. The email address format – firstname.lastname – can be gleaned from the legal notice on the company’s website. In addition, a certificate directory reveals a subdomain for a test portal that nobody maintains anymore.
An attacker would now have everything needed for a targeted attack: they know the VPN solution and can look for matching vulnerabilities. They know names and email addresses for phishing or password spraying. And the forgotten test portal gives them a possible way in. None of these steps required them to attack a single one of the company’s systems.
Why does this matter for businesses?
Reconnaissance is usually the first step in a targeted attack. The more an attacker knows about your company, the more convincing their emails and phone calls become. This extends all the way to CEO fraud, in which criminals pose as senior executives and order wire transfers – a typical form of social engineering.
OSINT also reveals your actual attack surface: systems nobody has on their radar anymore but that are still reachable from the internet. A clear warning sign is when your employees’ credentials turn up in data breaches or on the dark web, a hidden part of the internet that can only be reached with special software.
The upside for you: whatever attackers can find, you can find too – and you can find it first.
How to protect your organization
- Know your own footprint: Regularly check what can be found publicly about your company.
- Word job ads carefully: Describe tasks and skills without revealing the vendors and versions of your security technology.
- Remove metadata: Before publishing documents, strip out author names, file paths, and software details.
- Social media guidelines: Give your team practical advice on which professional details are better kept private.
- Shut down forgotten systems: Keep an up-to-date inventory of all domains and subdomains and take test and legacy systems offline.
- Raise team awareness: People who know how attackers do their research are more likely to recognize targeted inquiries and phishing emails.
How Rootsektor can help
In an OSINT assessment, we look at your company through an attacker’s eyes: we research which systems, details about people and technology, and leaked credentials can be found publicly, and we assess the risk. You receive a clear report with concrete, actionable recommendations. You can request a fixed-price quote after scoping via our Pentest Quote page.