What is OSINT and how it is used in corporate cyber threat intelligence
By Kike Gandia · Co-Founder & CEO, OSCP
OSINT (Open Source Intelligence) is the discipline of collecting and analyzing publicly available information — social media, public records, metadata, source code, specialized search engines — to reach useful conclusions about a person, company or infrastructure. In cybersecurity it's the foundation cyber threat intelligence (CTI) is built on: before you can get ahead of a threat, you need to know what information about your organization is already visible to an attacker.
What OSINT (Open Source Intelligence) is
OSINT is the collection of information from publicly accessible, legal sources: no intrusion, no unauthorized access to systems. The key isn't the access itself — the information is already public — but the search, correlation and analysis process that turns scattered data into useful intelligence. An OSINT analyst can reconstruct a company's org chart, its technology stack or its digital exposure surface by combining dozens of sources that, individually, don't say much.
What sources OSINT uses
- Social media and professional profiles (LinkedIn, X, Instagram): org charts, mentioned technologies, locations, habits.
- Public records: domain WHOIS, business registries, public tenders.
- Metadata from published documents (PDFs, images): authors, software used, internal network paths.
- Search engines specialized in exposed infrastructure: Shodan, Censys, FOFA.
- Public code repositories (GitHub, GitLab): forgotten credentials, architecture, dependencies.
- Forums, paste sites and known breach databases: leaked credentials associated with the domain.
- DNS records and SSL/TLS certificates: subdomains, cloud providers, exposed services.
Most widely used OSINT tools
These are the tools an offensive team uses during reconnaissance. None of them requires privileged access: they all query information that is already public.
| Category | Tool | What it is used for |
|---|---|---|
| Exposed infrastructure | Shodan, Censys | Services, ports and panels reachable from the Internet |
| Domain surface | Amass, Subfinder | Subdomain enumeration and forgotten assets |
| Certificates and DNS | crt.sh, SecurityTrails | Certificate history and records that reveal infrastructure |
| People and org chart | theHarvester, Hunter.io | Corporate email addresses and team structure |
| Leaked credentials | Have I Been Pwned, DeHashed | Exposure of the domain in known breaches |
| Metadata | ExifTool, FOCA | Authors, software and internal paths in published documents |
| Public code | GitHub code search, TruffleHog | Keys and secrets forgotten in repositories |
The tool matters less than the process: the value of OSINT lies in correlating findings from several sources, not in running a one-off scan.
The phases of a professional OSINT exercise
A corporate OSINT exercise is not a long Google search: it follows the classic intelligence cycle, the same one a CTI team applies.
| Phase | What happens | What it produces |
|---|---|---|
| 1. Direction | Define what you want to know and about which assets: domains, brands, staff with a public role | Signed scope and intelligence questions |
| 2. Collection | Systematic querying of open sources: DNS, certificates, repositories, breaches, metadata | Raw inventory of findings |
| 3. Processing | Normalization, deduplication and removal of noise and false positives | Verified dataset |
| 4. Analysis | Correlation across sources to turn loose data into conclusions | Findings prioritized by risk |
| 5. Dissemination | Report with evidence, impact and actionable recommendations | Executive and technical report |
The difference between an improvised search and an OSINT exercise lies in phases 3 and 4. Collecting is cheap and anyone can do it; discarding the noise and explaining what it means that a forgotten subdomain exposes an admin panel with leaked credentials of an employee who no longer works at the company is what turns data into intelligence.
OSINT vs CTI: where one ends and the other begins
OSINT is a source and a technique. Cyber threat intelligence (CTI) is a full process: it collects OSINT alongside private sources (dark web, threat intelligence feeds, telemetry), analyzes that information in an organization's specific context and produces actionable intelligence — which threat is relevant, what priority it has, what to do about it. In other words: OSINT feeds CTI, but CTI adds context, analysis and an action recommendation that OSINT alone doesn't provide.
Applications of OSINT in offensive security
OSINT is the first phase of almost any offensive security exercise. In a pentest or red team engagement, OSINT reconnaissance (MITRE ATT&CK catalogs it under the "Reconnaissance" tactic) maps the digital perimeter before touching a single system: which domains and subdomains exist, which technologies run on each, which employees are visible and in what role, what corporate information has leaked without the company knowing. In phishing simulations, OSINT on specific employees makes it possible to build realistic pretexts that measure the organization's real susceptibility, not a generic one.
Legal and ethical limits of OSINT
The guiding principle is simple: if the information requires bypassing an access barrier (password, authentication, permissions), it's no longer OSINT — it's intrusion, and becomes illegal without authorization. Professional OSINT is limited to genuinely public information and respects applicable data protection regulation (GDPR in the EU) when that information includes personal data: collecting data doesn't equal being free to use or publish anything found. A well-scoped corporate OSINT exercise focuses on the organization's exposure, not on investigating specific individuals without a legitimate, proportionate purpose.
In Spain the framework is specific: Article 197 of the Spanish Criminal Code punishes unauthorized access to systems and the interception of communications, so any attempt to get past a technical barrier falls outside OSINT. Personal data collected from open sources is covered by the GDPR and the LOPDGDD (Spanish Data Protection Act): being public does not make it free to process, and a legitimate basis, a defined purpose and the data minimization principle are still required. That is why a commissioned OSINT exercise is documented under a signed scope that sets out which assets and which data fall within the exercise.
How to start applying OSINT in your company
You don't need a full CTI program to get value from OSINT. A reasonable first step: check what shows up when searching your company's domain in Shodan or Censys, check whether corporate credentials appear in known breach databases, audit what sensitive information the metadata of published documents exposes, and set a clear policy on what staff can share on social media about their role and internal technologies. The natural next step is turning that one-off review into continuous monitoring — which is exactly what a cyber threat intelligence service covers.
FAQ
Is OSINT legal?
Yes, as long as it's limited to genuinely public information and doesn't require bypassing any access barrier (login, authentication, exploits). Subsequent use of that information — especially if it includes personal data — must comply with applicable data protection regulation.
What's the difference between OSINT and hacking?
Hacking involves accessing protected systems or data, typically without authorization when it is malicious. OSINT never crosses that line: it works exclusively with information already publicly accessible. They are different phases of the same offensive security exercise: OSINT is reconnaissance, not exploitation.
Do I need special tools to do OSINT?
There are specialized tools and search engines (Shodan, Censys, theHarvester, metadata search tools) that speed up the process a lot, but the starting point — general search engines, social media, WHOIS — is freely accessible. The real value is in the skill to correlate information, not just the tool.
What does OSINT stand for?
OSINT stands for Open Source Intelligence. The term comes from military and government intelligence, where it is distinguished from other disciplines by where the information comes from: instead of intercepting communications or relying on human sources, it works with what is publicly accessible. "Open" refers to the source, not to the information being meant for sharing.
What is the OSINT Framework?
The OSINT Framework (osintframework.com) is a free web directory that organizes hundreds of OSINT tools and resources in a tree by category: usernames, email addresses, domains, IP addresses, images, social networks or public records. It is not a tool in itself but a map to find the right one for each search. It is a good starting point, although it is worth checking that each resource is still live and that using it fits the GDPR.
How is artificial intelligence used in OSINT?
Mostly for what takes the most time: summarizing and translating large volumes of text, extracting entities (names, domains, job titles) from documents and correlating findings across sources. What AI does not solve is verification: a language model can invent data or attributions with complete confidence, so every conclusion has to be checked against the original source before it goes into a report. And if personal data is processed with third-party services, the GDPR applies all the same.
Can you run an OSINT assessment of my own company?
Yes, and it is the most direct way to know what an attacker sees before they use it. A corporate OSINT exposure assessment reviews domains and subdomains, exposed services, leaked credentials, metadata in published documents and the information staff make public about the organization, and delivers prioritized findings with recommendations. It is done under a signed scope and without interacting with your systems.
Related service
Cyber Threat Intelligence (CTI) service
Related content
- Honeypot as a Service: detecting the attacker on their first move
- Ethical hacking for businesses
- See OSINT in the offensive cybersecurity glossary
- External ethical hacking (reconnaissance and perimeter)