Open-source intelligence (OSINT) is the reconnaissance phase of almost every targeted attack — and it uses only public information: your domain records, employee lists, leaked passwords from old breaches, exposed services, metadata in your own documents, and social media. An afternoon of it produces a startlingly complete map of how to attack you. The defense isn't secrecy; it's reducing and monitoring your public footprint.
When we run an OSINT engagement, clients are rarely shocked by any single finding — they're shocked by the picture the findings assemble into. Individually public facts, combined, become an attack plan. This is a walk through that process, defensively: what a motivated stranger can compile about your company before touching a single system, in roughly the order they'd do it, and what to do about each layer. Reconnaissance is a recognized first phase of adversary behavior in the MITRE ATT&CK framework — this is that phase, from the other side.
Layer 1 — Your internet-facing footprint
The starting point is what your domain and infrastructure announce to the world. Public DNS records reveal your mail provider, your hosting, sometimes your security tooling. Certificate transparency logs — a public record of every TLS certificate issued — quietly list subdomains you may have forgotten: staging., vpn., old-portal., the dev box someone stood up in 2023. Search engines built for internet-connected devices index your exposed services, open ports, and the software versions running on them. None of this requires intrusion; it's all published. And it's often where the first real weakness surfaces — the forgotten staging server with weak credentials that we described chaining into a full compromise in our pen test examples.
Layer 2 — Your people
Attackers map your org because people are the way in. Professional networks give names, roles, tenure, and reporting lines — enough to know who has access to what, who's new (and thus unsure of process), and who to impersonate. Job postings are unintentionally generous: "experience with [specific firewall], [specific EHR], [specific cloud]" tells an attacker your exact technology stack. Conference talks and podcasts reveal architecture and tooling. From this layer alone, an attacker builds a target list for phishing and a script for impersonation — the finance clerk who reports to the CFO who's currently speaking at a conference (so, conveniently, unreachable for a quick verification call).
Layer 3 — Credentials from old breaches
Years of third-party breaches have put billions of email/password pairs into circulation. An attacker cross-references your employees' addresses against these corpuses and frequently finds a real password — one that still works, because it was reused, or that reveals the person's password pattern. This is why credential stuffing is a first move, not a last resort: for a meaningful share of companies, a valid login is sitting in a public dataset waiting to be tried.
Layer 4 — Metadata in your own documents
The files you publish carry more than their contents. PDFs, images, and office documents embed metadata: author names, internal usernames, software versions, sometimes folder paths and internal server names. A company's public brochure has revealed its internal Active Directory username format; a photo on a "careers" page has shown the office layout and the badge-reader brand. It's information you gave away without meaning to, sitting in files you intended to share.
Layer 5 — The assembled picture
Here's where it becomes an attack, because the layers combine. Certificate logs reveal vpn.yourcompany.com (Layer 1). A job post names the VPN vendor (Layer 2). An old breach yields a valid credential for an employee (Layer 3). That employee's role, from their public profile, suggests access worth having (Layer 2). The attacker now has a specific target, a specific service, a specific credential to try, and MFA is the only thing standing between reconnaissance and intrusion — which is the entire reason MFA is the recurring hero of everything we write. No single fact was secret. The combination was the vulnerability, and it was assembled in an afternoon with free tools.
What we hand clients at the end of an OSINT review
The deliverable isn't a scary list — it's a prioritized reduction plan. We show the assembled picture (so leadership understands the stakes viscerally), then the specific closures ranked by impact: usually MFA and credential hygiene first (Layer 3, highest leverage), forgotten-subdomain cleanup and exposure reduction next (Layer 1), then process controls for impersonation (Layer 2), then the housekeeping of metadata (Layer 4). The goal is never "become invisible" — that's impossible and unnecessary. The goal is to raise the cost and effort of targeting you enough that opportunistic attackers move on and targeted ones leave traces while they work. Reconnaissance you can see is reconnaissance you can defend against — which is why the OSINT that attackers use offensively, we use defensively.
Run a basic version on yourself this week
You don't need us to start — a first-pass self-assessment is genuinely doable and instantly clarifying. Domain: look up your public DNS records and search certificate-transparency logs for your domain to list every subdomain that has ever had a certificate — then ask which of those you forgot existed. People: view your own company on the major professional network as a logged-out stranger, and read your last three job postings the way an attacker would, noting every named technology. Credentials: check your work email addresses against reputable breach-notification services and see what surfaces. Documents: download a few PDFs and images from your own website and inspect their properties for author names, usernames, and software versions. Assemble: lay the findings next to each other and ask the uncomfortable question — if a stranger had only this, what's their first move? Most companies find at least one forgotten subdomain, one over-sharing job post, and one document leaking an internal username within an hour. That hour is the entire point: you can't reduce a footprint you've never looked at, and looking is free. When you want the thorough, monitored version — and the closures prioritized — that's the engagement we run.
Why we publish this instead of keeping it as a trade secret
A fair question: if OSINT is how attacks start, why write the map down? Because none of this is secret to attackers — the tools are free, the techniques are documented, and the people who do this for a living already know every layer above. The only people not using this knowledge are the defenders it would help most: the small companies who've never thought about their own footprint because nobody showed them how to look. Security through obscurity fails precisely here — pretending the reconnaissance surface doesn't exist doesn't protect you; it just means the attacker is the only one who's seen your file. Publishing the defensive version levels that specific asymmetry. The genuine expertise isn't knowing that certificate-transparency logs exist; it's compiling the full picture efficiently, judging what actually matters, and prioritizing the closures — which is the engagement, not the article. What you can do from this page is start looking, and starting is most of the value.
Frequently asked questions
Is OSINT legal?
Using public information is legal — that's what makes it powerful and what makes it a defensive necessity. It crosses into illegality when it involves unauthorized access, deception to obtain non-public data, or misuse of the information. Defensively, running OSINT on your own organization is simply reconnaissance against yourself, which is entirely appropriate and highly recommended.
Can we remove ourselves from the internet entirely?
No, and it's the wrong goal. A business needs a public presence to function. The objective is a deliberate footprint — publish what serves you, remove what only serves an attacker (forgotten subdomains, leaked credentials, document metadata), and monitor for new exposure. Reduction and awareness, not disappearance.
How often does our footprint change?
Constantly. New employees post profiles, new subdomains appear, new breaches surface old passwords, new documents get published. A one-time cleanup decays; treat OSINT exposure like vulnerability management — a periodic review (quarterly is reasonable) plus monitoring for high-signal changes like fresh credential leaks.
Is this the same as a penetration test?
It's the reconnaissance phase that precedes one. A penetration test then acts on what recon finds — attempting exploitation with permission. OSINT alone is passive information-gathering; it tells you what an attacker would learn before touching your systems. Many engagements start with OSINT precisely because it shapes where the active testing should focus.
What's the single highest-impact thing to fix?
The credential layer: MFA everywhere plus killing password reuse. It directly defeats the most common attack path OSINT enables — a valid, leaked credential tried against an exposed service. Everything else raises the attacker's cost; MFA changes whether the easiest path works at all.
See your OSINT profile Our OSINT practice
Sources: MITRE ATT&CK — Reconnaissance (TA0043). General guidance from our OSINT engagements; techniques are described defensively to help organizations reduce their own exposure.