Leaked credentials
Corporate email addresses together with passwords from data breaches at third-party providers – dangerous when passwords are reused or MFA is missing.
Security Services
OSINT Assessment for Businesses
See your company through an attacker’s eyes
Every targeted attack begins with research. Our OSINT assessment shows what criminals can learn from public sources about your company, your systems, and your employees – and how you can deliberately shrink this digital footprint.
- Fixed price after scoping
- Quote within 24 hours
- Public sources only
Definition
What is an OSINT assessment?
OSINT stands for open source intelligence – the systematic collection and analysis of freely available information. In an OSINT assessment – sometimes also called an OSINT analysis – we apply the methods attackers use to scout their targets, but on your behalf and with a clear outcome: a reliable picture of your digital footprint.
The sources are diverse: your website, the commercial register, job postings, professional networks, social media, code platforms, DNS and certificate data, search engines, public documents, and known data breaches. Individually, the findings seem harmless. Combined, they often add up to an attack plan – for example, when an org chart, the email address format, and the software named in a job posting together make a convincing spear-phishing campaign possible.
You benefit from the results in two ways: First, you can assess your social engineering risk – which people are particularly exposed, and which pretexts would be credible? Second, you shrink your technical attack surface by tracking down and shutting off forgotten subdomains, test systems, and shadow IT. An OSINT assessment is also useful preparation for penetration tests and red teaming exercises.
We operate within clear boundaries: we evaluate only freely accessible sources, never log in with credentials we find, and never bypass access restrictions. We process personal data in line with the principles of the GDPR – for a specific purpose, limited to what is necessary, and only for as long as agreed.
Our approach
How we build your OSINT picture
We start with what you tell us – company names, brands, domains, locations, and key people – and expand the picture step by step, the way an attacker would: from certificate data to forgotten subdomains, from job postings to the software in use, from professional networks to names, roles, and email formats.
The research remains passive: we don’t attack your systems, we access public services only the way any visitor could, and we don’t contact anyone. Automated tools produce many false hits – which is why we check every hit by hand: Does the subdomain really belong to you, and does the account from the data breach even still exist? From the confirmed findings, we then derive realistic attack paths – from a phishing scenario to an entry point via a forgotten test system.
Typical findings
What an OSINT assessment often uncovers
Forgotten subdomains & shadow IT
Old test systems, staging environments, admin interfaces, or cloud services that business units have set up without involving IT.
Metadata in documents
PDFs and Office files on your website often reveal usernames, software versions, internal file paths, or server names.
Exposed employee data
Names, roles, direct dial numbers, and responsibilities from professional networks and team pages – the raw material for spear phishing and CEO fraud.
Overly revealing job postings
Job ads name the firewalls, ERP systems, and cloud platforms in use – sometimes even with version numbers.
Photos with side effects
Office and production photos on social media show access badges, whiteboards, screen contents, or building entrances.
Access keys in public code
An accidentally public repository or an entry on a paste site is enough to expose API keys or cloud credentials – often even after the affected file has been deleted, because the version history preserves them.
Spoofable senders & typosquatting
Incomplete SPF, DKIM, and DMARC records and lookalike domains make phishing in your company’s name easier.
Options
The right OSINT assessment for your goal
Infrastructure
Technical attack surface
Focus on domains, subdomains, exposed services, certificates, and shadow IT.
- Useful before an external pentest
- Comparison with your asset inventory
- Basis for hardening and decommissioning
Social engineering
Human attack surface
Focus on employees, organization, data leaks, and communication channels.
- Assessment of phishing and vishing risk
- Starting points for targeted awareness measures
- Basis for realistic social engineering scenarios
Combined
Complete picture
Technical and human perspectives, linked into concrete attack paths.
- Correlation of all findings into attack chains
- Prioritized list of measures
- Optionally as a kickoff for red teaming
Process
Your OSINT assessment in five steps
Clear boundaries, verified findings, and a result you can work with right away – just what you can expect from all our security services.
-
01
Scoping & ground rules
Together, we determine which companies, brands, and domains are in scope, which groups of people are included, and what remains off-limits, such as private profiles. After scoping, you receive a fixed-price quote within 24 hours (on business days).
-
02
Research
We evaluate what anyone can find – from the commercial register and the legal notice (Impressum) on your website to certificate and DNS data, web archives, professional networks, code platforms, and published data breaches.
-
03
Verification & assessment
We confirm every hit by hand and assess how easily it could be exploited and what damage could result.
-
04
Correlation
We put the individual findings together like puzzle pieces and show which combinations would actually pave an attacker’s way into your company.
-
05
Report & cleanup
You receive a clear picture of your exposure with prioritized recommendations. If you wish, we discuss the results together and help you remove and restrict exposed information.
Reporting
Your OSINT picture – clear and prioritized
The report shows what can be found publicly about your company, how attackers could use this information, and what you can do about it – easy to understand for management, with hard facts for your IT team. We present personal findings in as data-minimizing a way as possible: passwords only masked, employees by role rather than by name wherever that is sufficient for the assessment.
- Executive summary with an overall rating of your exposure
- Overview of all domains, subdomains, and services found
- Verified findings with source, date, and risk rating
- Description of realistic attack paths
- Prioritized measures: remove, restrict, monitor
- Recommendations for social media and publication policies
Make unknown attack surface visible
With an OSINT assessment, you see what attackers can find out about you – before they use it. We advise you without obligation and prepare a fixed-price quote within 24 hours of scoping (on business days).
FAQ
Frequently asked questions about the OSINT assessment
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Is an OSINT assessment legal?
Yes, if it is clearly scoped. We evaluate only freely accessible information, act solely on your behalf, never log in with credentials we find, and never bypass access restrictions. Nor do we contact your employees under a false identity. Because publicly available personal data also falls under the GDPR, we define the purpose and scope in advance and process only what is necessary for the risk assessment.
How does the OSINT assessment differ from dark web monitoring?
The OSINT assessment is a snapshot of your entire digital footprint – technology, organization, and people. Our dark web monitoring, by contrast, uses our in-house applications to continuously and automatically monitor whether your data turns up on the dark web and notifies you of findings; afterward, we support you individually with countermeasures. The two complement each other well.
Is an OSINT assessment the same as a vulnerability scan?
No. The OSINT assessment remains passive and doesn’t attack your systems. Active scans and attack attempts are part of a vulnerability assessment or a penetration test. The OSINT assessment often serves as a first step to define the scope for these tests properly.
Do you also examine private social media profiles?
Only to the extent that they are relevant to the company’s risk and this has been agreed in advance. We focus on professional profiles and public content related to your company, not on the private lives of individuals. We define the boundaries together during scoping.
Should we inform the works council and staff?
Because personal data of employees is also examined, we recommend involving the works council (or, in the public sector, the staff council) and your data protection officer in advance. Your employees won’t notice the research, since no one is contacted. Whether and how to inform the workforce is best decided together with these bodies – we’re happy to support you with the communication.
What happens to the data you find?
We treat all findings confidentially and use them exclusively for your engagement. We agree on the retention and deletion of the raw data with you in advance. In the report, passwords appear only masked and people, where possible, only by their role.
What can we do about the information you find?
A lot can be fixed directly: shut down test systems, remove metadata, reset passwords and enforce MFA, tighten DMARC, and adjust team pages. For content on third-party platforms, removal requests help; for personal data, those affected can invoke their right to erasure under Art. 17 GDPR. You can counter the risks of information that can’t be removed with awareness training and monitoring.
How often should an OSINT assessment take place?
Your digital footprint changes constantly – through new employees, projects, cloud services, and publications. We recommend repeating it roughly once a year and on specific occasions, such as before an external pentest, after mergers or name changes, and after major cloud migrations.
Related pages
Let’s talk about your OSINT assessment
Tell us which companies, brands, and domains should be examined. We’ll suggest the right scope and prepare a fixed-price quote after scoping.