OSINT — open-source intelligence — is intelligence produced from publicly available information: websites, DNS records, social media, code repositories, company registries, breach data and more. Collecting it requires no hacking at all, which is precisely what makes it dangerous: an attacker can build a detailed picture of your organisation without ever touching your network. Here's how that works, and what defenders should do about it.
What counts as open-source intelligence?
If it can be accessed without authentication or special privileges, it's open source. The raw material is public information; it becomes intelligence when someone collects, correlates and analyses it with a goal in mind. The sources attackers care about fall into a few buckets:
- Corporate sources — your website, job ads, press releases, annual reports, ASIC and other company registries
- Technical sources — DNS records, certificate transparency logs, WHOIS data, internet-wide scan databases
- People sources — LinkedIn, social media, conference talks, podcast appearances, personal blogs
- Code and documents — public Git repositories, paste sites, exposed cloud storage, metadata inside published files
- Breach data — credential dumps and infostealer logs circulating on forums and messaging channels
None of this is secret. The asymmetry is that attackers collect it systematically, and most organisations have no idea what's out there.
How attackers use OSINT against organisations
Reconnaissance is the first phase of almost every real-world intrusion, and most of it is OSINT. A capable attacker typically works through four threads in parallel.
Mapping your infrastructure
Certificate transparency logs, DNS datasets and scan databases reveal your subdomains, IP ranges, cloud tenants and third-party services — often including staging environments and forgotten systems that nobody is patching. This is the raw input for choosing a technical way in. We've covered this in more depth in our guide to external attack surface management.
Mapping your people
LinkedIn alone can reconstruct an org chart: who runs finance, who answers the IT helpdesk, who just started and doesn't know the internal processes yet. Combine that with your email naming convention — usually derivable from one or two public addresses — and an attacker has a ready-made target list for phishing and social engineering.
Hunting credentials and secrets
Breach dumps and infostealer logs frequently contain working corporate credentials. Public code repositories leak API keys, tokens and internal hostnames. If any of those secrets still work, the attacker doesn't need an exploit at all — they log in. We've written a separate guide on what to do about leaked credentials.
Profiling your technology stack
Job ads that list your stack, HTTP response headers, error pages and developers asking questions on public forums all tell an attacker what software you run — and therefore which vulnerabilities and misconfigurations to try first.
Why OSINT is hard to defend against
Passive collection generates no traffic to your systems. There is nothing to detect and nothing in your logs. You can't stop someone reading certificate transparency logs or LinkedIn. The only workable defence is knowing what's exposed before the attacker does, and shrinking it where you can.
The defender's view: turn OSINT on yourself
The most effective response is to run the attacker's playbook against your own organisation. A proper OSINT assessment answers questions like:
- What infrastructure is publicly attributable to us, including things we forgot we had?
- Which staff credentials appear in breach data or stealer logs?
- What secrets have leaked through code, documents or misconfigured storage?
- What could an attacker learn about our people and processes to make social engineering convincing?
This is core work for us at Ironbark. Our team builds OSINT and reconnaissance tooling used by security teams and researchers worldwide, and we apply the same techniques on OSINT and reconnaissance engagements for clients.
Reducing your OSINT exposure
You'll never get to zero, and you shouldn't try — much of your footprint exists for good business reasons. Focus on the exposure that carries real risk:
- Maintain an inventory of internet-facing assets and decommission what you no longer need
- Strip metadata from documents before publishing them
- Monitor breach data and stealer logs for your domains, and reset exposed credentials fast
- Keep secrets out of public repositories, and scan for the ones already there
- Brief high-risk staff — executives, finance, IT — on what they share publicly; see our post on executive digital footprints
- Reassess periodically: footprints grow every time you ship, hire or acquire
FAQ
Is collecting OSINT legal?
Generally yes. OSINT uses information that is already public, so collecting it is lawful in most jurisdictions. What you do with it can be unlawful — fraud, stalking, unauthorised access — and handling stolen data raises its own legal issues. Defensive OSINT on your own organisation is standard practice. (General information, not legal advice.)
What's the difference between OSINT and reconnaissance?
Reconnaissance is the attack phase; OSINT is the passive, public-source part of it. Recon can also include active techniques — port scanning, service probing — that touch your systems directly. OSINT never does, which is why you can't see it happening.
Can we stop attackers gathering OSINT on us?
No. You can't remove your organisation from public records and you can't detect passive collection. What you can do is know your own exposure, remove the unnecessary parts, and harden the people and systems most likely to be targeted with what remains.
Want to know what an attacker can find on your organisation before they go looking? We run OSINT and attack surface assessments with a fixed quote within one business day of a free scoping call — get in touch.
Need cybersecurity expertise?
Drop your email and we'll be in touch within one business day.