Reconnaissance
In an attack context, reconnaissance is information gathering used to understand a target and plan or refine an operation.
A name, a supplier relationship, or a reachable service can help someone choose what to target. MITRE’s Reconnaissance tactic includes gathering information about organizations, infrastructure, and people through both passive research and direct interaction.
Public research is only one route
Open-source intelligence uses publicly or commercially available information. Reconnaissance can draw on that work, but it can also involve active probes of infrastructure or questions sent directly to a target. MITRE’s Active Scanning technique specifically describes probes that generate network traffic to the target.
The same technical activity can serve different purposes. A scan may belong to an authorized assessment, an attacker planning access, or activity after an intrusion. The traffic alone does not establish the operator’s intent or position in an attack sequence.
Someone Already Mapped Your People explains how public information can make impersonation more convincing. It does not establish that every exposed detail has been collected by an attacker.
Turn exposure into a question worth testing
Ask what the discovered information would help someone request or reach. A staff directory may support a believable help-desk story; it does not prove that the desk will accept it. The workflow-prioritization article connects that exposure with the authority and controls worth examining.
For authorized research, keep the targets and permitted collection methods within scope. Preserve the source and its date so an old observation is not silently treated as the organization’s current state.