OSINT: what the internet already knows about you and your organisation

OSINT, open-source intelligence, is information gathered from publicly available sources: websites, social networks, job adverts, public records, code repositories, news and leaked data sets. Attackers use it to plan; defenders use it to see themselves the way an attacker does. MITRE ATT&CK lists these activities under reconnaissance, with techniques such as gathering victim identity information and searching open websites and domains.

Why OSINT is so powerful

Passive reconnaissance does not touch the target’s systems at all, so it triggers no alert. By the time a phishing email arrives, the attacker may already know your name, your role, your manager’s name, the software your team uses and how your company formats email addresses. Social engineering works because it is built on this kind of detail; the more specific a message is, the more believable it feels.

What an organisation leaks without meaning to

The personal side

For an individual, the same logic applies. Birthdays, a pet’s name, a school, a holiday photo with a boarding pass, a home address from a data broker: each is harmless alone and useful to someone guessing security questions or impersonating you. People most at risk, such as journalists, activists and people escaping abuse, benefit most from reviewing their footprint. CISA publishes guidance specifically for high-risk communities.

OSINT in a professional test

In an authorised penetration test or red team exercise, OSINT is usually the first phase and one of the most eye-opening parts of the report. Showing leadership how much can be learned in an afternoon, from public sources only, often does more for security awareness than any training slide. Even passive research on real people should stay within the agreed scope and respect privacy law: collect only what the test needs, and protect what you find.

Shrinking your footprint

• Search for your organisation and yourself the way an attacker would, and write down what you find.
• Remove metadata from documents before publishing them; keep job adverts free of internal version details.
• Scan code repositories for secrets, and rotate any key that has ever been published, even briefly.
• Check whether your addresses appear in known breaches, and never reuse passwords between services.
• Limit what staff profiles expose about internal structure, and teach people to verify unusual requests through a second channel.
• Ask data brokers to delete your records where the law allows it.

Your computer leaks too

Not all exposure is on the web. Apps quietly send analytics and telemetry that reveal what you use and when. FireAI shows each app’s connections on a world map, and in Paranoid mode it blocks telemetry, which reduces the trail your Mac leaves behind without you noticing. It does not remove what is already public; that part is up to the steps above.