What is OSINT (open source intelligence)?
OSINT (Open Source Intelligence) is the discipline of collecting, analyzing and correlating publicly available information to produce intelligence: social media, public records, metadata, leaks, specialized search engines and the open web. It's the foundation of reconnaissance in pentesting, investigations and cyber intelligence.
OSINT techniques and tools
It includes advanced search with operators (Google Dorking), reverse image search, username profile enumeration (WhatsMyName, Maigret), domain and metadata analysis, and data-breach lookups. The key isn't the tool but the method: start from one data point and expand the information graph until you answer the investigation's question.
OSINT in cybersecurity
An attacker does OSINT to profile a target before striking; a defender does it to know their own exposure surface and get ahead. Mastering OSINT — now supercharged with artificial intelligence — is one of the most in-demand skills in the field.
What counts as open source and what does not
Open source is any information legally reachable without breaking a control: public records, professional profiles, code repositories, certificate transparency logs, DNS records, press archives, published images. The line is crossed the moment you must bypass authentication, accept terms you then breach, or access leaked data. That distinction is not academic: it determines whether the work is admissible or a crime.
The intelligence cycle in practice
Collecting without a prior question produces mountains of useless data. The cycle begins by defining what needs to be known and for which decision; continues with collection aimed at that question; proceeds to processing and verification, where stale material is discarded and every item is corroborated against a second source; and ends with analysis and delivery in a format someone can act on. A report that merely piles up findings without interpreting them is not intelligence.
The mistakes that invalidate an investigation
Accepting a fact because it appears in several places, when all of them copied the same original source. Confusing a name match with identity. Using expired information without checking its date. And the costliest: contaminating the investigation by leaving traces — visiting profiles from an identifiable account, querying the target's domains from your own network, or running searches that alert the subject.
