OSINT: Open Source Intelligence
Open Source Intelligence (OSINT) is the discipline of collecting, analyzing and using information from publicly accessible sources for intelligence and security purposes. In cybersecurity, OSINT is both a fundamental tool for defensive security teams and one of the first stages of an attack for adversaries.
OSINT in Corporate Cybersecurity
Every organization has a digital footprint, information about employees, infrastructure, technologies in use and business relationships, that is visible from open sources. Attackers systematically gather this information during reconnaissance to identify attack vectors. Fidem’s OSINT service reverses this dynamic: we use the same techniques and tools as adversaries to identify and reduce the organization’s information exposure.
Areas of Application
Reconnaissance of the Exposed Surface
We map the organization’s entire digital footprint: domains and subdomains, IP addresses, exposed services, indexed company email addresses, documents with sensitive metadata published online, social profiles of key employees, technology information that can be derived from HTTP headers and DNS. This visual assessment produces a report showing exactly what a potential attacker can discover before launching an attack.
Dark Web Intelligence
We extend OSINT reconnaissance to dark web channels, monitoring cybercriminal forums, credential marketplaces, paste sites, Telegram channels and underground communities to identify:
- Company credentials compromised in data breaches
- Mentions of the organization in malicious contexts
- Sales of VPN, RDP or shell access to the infrastructure
- Phishing kits that use the company brand
Social Engineering Assessment
OSINT is the basis of any social engineering operation. We analyze the exposure of key employees on social networks (LinkedIn, Facebook, Instagram), identifying information that could be exploited for spear phishing, pretexting or vishing campaigns. This assessment feeds directly into our Red Teaming services.
Competitive and Threat Intelligence
We provide strategic intelligence gathered from open sources: analysis of attack trends in the client’s sector, monitoring of relevant zero-day vulnerabilities, tracking of APT (Advanced Persistent Threat) campaigns active in the target market.
Methodology and Tools
Fidem’s OSINT team uses a combination of open source and proprietary tools, including automated reconnaissance frameworks, specialized search engines, metadata analysis tools and social media intelligence platforms. Our methodology follows the standard OSINT cycle: Planning → Collection → Processing → Analysis → Dissemination.
Integration with Fidem Services
OSINT is not an isolated service: it is integrated with Fidem’s entire offensive security ecosystem:
- Penetration Testing: OSINT feeds the reconnaissance phase
- Red Teaming: social engineering based on real intelligence
- Digital Identity Protection: continuous monitoring of exposure
- Web Reputation: proactive brand protection
Request an OSINT assessment to find out what an attacker could find about your organization.
What is OSINT?
OSINT is the collection and analysis of information that is already public, to understand what an attacker can know about your organization without breaching anything. Names and roles on social media, email addresses in the company format, documents indexed by mistake, credentials that appeared in third-party breaches, exposed systems nobody remembered switching on.
What it is used for in practice
- Before a targeted attack: it is where someone preparing a credible phishing email starts; knowing what can be found lets you reduce it.
- Exposed surface: services reachable from the Internet that do not appear in any inventory.
- Compromised credentials: company accounts that appeared in breaches of external services, often with reused passwords.
- Supplier checks: how exposed are those who have access to your systems.
- Support for a forensic examination: in forensic investigations OSINT documents the public context of a fact.
Is it legal?
Yes, as long as it stays on genuinely accessible sources and does not bypass any access control. The line is clear: consulting a public profile is OSINT; using credentials found in a breach to get into an account is not, and it is a crime. We work only within the first perimeter, and the processing of personal data collected follows GDPR rules exactly like any other processing.
What it is NOT
OSINT is not private investigation: activities reserved for licensed agencies are not part of our services. It is not access to non-public data. And it does not replace a vulnerability assessment: it tells you what is visible, not how vulnerable it is.
How an OSINT analysis is carried out: the phases
A serious OSINT analysis is not a Google search: it is a process with a declared scope, traced sources and a repeatable result. There are four phases:
- Defining the scope: which domains, brands, people with public roles and suppliers are included. Without this step collection becomes endless and unusable.
- Collection: on accessible sources: public registers, DNS and certificates, archives of known breaches, code repositories, social media and industry portals.
- Verification: the phase that distinguishes professional work: data found is not data proven. Every element has to be corroborated before it ends up in a report.
- Analysis and delivery: which of all this is a concrete risk, in what order it should be tackled, and what can reasonably be removed.
Tools and frameworks: what really matters
The lists of OSINT tools found online are long and mostly irrelevant: the result depends on the method, not the tool. The families we use are few: domain and subdomain reconnaissance, analysis of certificate transparency logs, queries of compromised credential archives, searches in code repositories, monitoring of brands and similar domains.
What tool catalogs do not tell you: most real exposures are not found with an exotic tool, but by looking at what the company publishes itself: job ads that list the technology stack, presentations uploaded by mistake, test subdomains left online, keys that ended up in a public repository.
OSINT and cyber threat intelligence: how they relate
OSINT is one of the sources of threat intelligence, not a synonym. Threat intelligence answers “who could attack us and how”; OSINT answers “what can be known about us without breaching anything”. The second question is the premise of the first: an attacker starts from there.
In our work OSINT feeds three different activities: preparing a penetration test (initial reconnaissance is OSINT), digital identity protection (credentials and imitation domains), and the public context of a digital forensic examination.
OSINT on suppliers: the question that comes from customers
More and more often it is not the company that wants the analysis: its customer asks for it, or the company has to run it on its own suppliers. NIS2 explicitly addresses supply chain risk, and checking how exposed those with access to your systems are becomes part of the obligations, not a courtesy.
On a supplier the analysis looks at the same things: exposed surface, credentials that appeared in breaches, domain hygiene. The difference is that the result serves a contractual decision, so it has to be written so that non-technical readers can follow it too.
How often it makes sense to repeat it
Doing it once is of little use: the exposed surface changes by itself. A certificate issued, a subdomain published, a breach of a third-party service involving company accounts: these events happen without anyone in the company noticing. That is why a one-off analysis takes a snapshot, while continuous monitoring is what catches the change. Terms in the glossary.
Definitions: OSINT · attack surface management in the cybersecurity glossary.