Open-source intelligence
Open-source intelligence is intelligence produced from publicly or commercially available information to answer a defined question or information need.
Start with a question
OSINT turns public information into an answer to a specific question, such as which public pages reveal a company’s support relationships. The 2024 ODNI and CIA strategy announcement includes publicly or commercially available information; “open-source” does not always mean free.
MITRE documents attackers researching public websites, social media, and business operations to choose and prepare targets. Defenders can review their own exposure to see which details might make an impersonation more convincing.
Check what the source actually supports
An old job listing that names a product suggests the company used it at that time. It does not prove the company still uses it or that the product is vulnerable.
Keep source URLs, retrieval dates, and the passages supporting your conclusion. Check whether apparently independent pages copied the same source and whether the information is still current.
Agree which people, sources, and uses are in scope. Aim for a finding someone can act on, such as a help desk using publicly discoverable employee details to verify callers.