What Is OSINT?
OSINT is the collection and analysis of publicly available information for intelligence purposes.
OSINT Sources and Techniques
LinkedIn and Professional Networks
LinkedIn provides attackers with organizational charts, employee names and roles, technology stack details from job postings, and relationship maps that identify who has authority over what decisions. A targeted attacker researching a company will analyze LinkedIn to identify the CFO's name, the IT help desk structure, which employees have privileged access roles, and who has recently changed jobs or posted about projects.
Domain and Certificate Intelligence
WHOIS records, certificate transparency logs, Shodan, and similar tools reveal an organization's internet-facing infrastructure. Certificate transparency logs record every SSL/TLS certificate issued for a domain, exposing subdomains, development environments, and cloud services that organizations may not realize are discoverable. Shodan indexes internet-connected devices and their banners, revealing exposed services, software versions, and configuration details.
Code Repositories
GitHub, GitLab, and similar public repositories frequently contain accidentally committed credentials, API keys, and internal infrastructure details. Developer repositories that include configuration files, environment variables, or commented-out credentials represent one of the most consequential OSINT sources for credential theft.
Defensive OSINT
Defensive OSINT — assessing your own organization's external exposure from an attacker's perspective — is one of the most valuable and underutilized security practices. Organizations that conduct regular OSINT assessments of their own footprint discover exposed credentials in code repositories, forgotten internet-facing systems, excessive employee information on professional networks, and domain configurations that enable spoofing attacks. This discovery occurs before attackers find the same information.
OSINT in M&A Due Diligence
Cloudskope conducts OSINT-based external exposure assessments as standard components of M&A cyber due diligence. An OSINT assessment of an acquisition target requires no cooperation from the target and reveals the internet-facing exposure, credential exposure in public repositories, and organizational intelligence that attackers would use to plan a targeted attack. These findings consistently surface material security issues not documented in the target's security documentation.
Related Reading
What is OSINT?
Open Source Intelligence — OSINT — is the collection, analysis, and application of information gathered from publicly available sources to produce actionable intelligence. Sources include social media, public websites, corporate filings, domain registration records, certificate transparency logs, job postings, code repositories, and any other information accessible without authentication or legal restriction. OSINT is the foundation of both offensive operations — attackers researching targets before launching attacks — and defensive operations — defenders assessing their own external exposure.
What's the difference between OSINT and threat intelligence?
OSINT is the broader category of intelligence gathered from publicly available sources, used for many purposes including target research, due diligence, journalism, and security. Threat intelligence is the application of intelligence — including OSINT, plus commercial feeds, ISAC sharing, government sources, and internal telemetry — specifically to understanding adversary capability and intent. OSINT contributes to threat intelligence but is also used independently for direct security purposes like external exposure assessment, brand monitoring, and M&A due diligence.
What are the most important OSINT sources for attackers and defenders?
LinkedIn for organizational structure, employee names and roles, and technology stack details from job postings; certificate transparency logs (crt.sh) for discovering subdomains and infrastructure; Shodan and Censys for internet-facing service discovery; GitHub and GitLab for exposed credentials and infrastructure details in code; DNS records and WHOIS for domain ownership and infrastructure relationships; and breach data aggregators (HaveIBeenPwned, DeHashed) for exposed credentials. The same sources that attackers use for target research can be used defensively for organizational external exposure assessment.
What OSINT tools are most commonly used?
Maltego for relationship mapping and visual intelligence analysis; SpiderFoot for automated reconnaissance across multiple sources; theHarvester for email and subdomain enumeration; Recon-ng for modular OSINT collection; Shodan for internet-facing infrastructure; crt.sh for certificate transparency searches; Pipl for personal information aggregation; and OSINT Framework as a curated index of tools by source type. Commercial platforms — DomainTools, Recorded Future, Flashpoint — aggregate OSINT with proprietary sources for enterprise threat intelligence applications.
How is defensive OSINT used to reduce risk?
Defensive OSINT assesses your own organization's external exposure from an attacker's perspective. Organizations that conduct regular OSINT assessments of their own footprint discover exposed credentials in code repositories, forgotten internet-facing systems, excessive employee information on professional networks, and domain configurations that enable spoofing attacks — before attackers find the same information. The discovery process is the security control: information remediated before exploitation cannot be used in an attack. Defensive OSINT is among the highest-leverage security practices and one of the most underutilized.
How is OSINT used in M&A due diligence?
OSINT-based external exposure assessment provides material due diligence intelligence without requiring cooperation from the target. The assessment reveals internet-facing infrastructure exposure, credential exposure in public repositories, organizational intelligence accessible to attackers, and domain configuration weaknesses that enable spoofing — all from the attacker's perspective. These findings consistently surface security issues not documented in target security questionnaires and inform integration planning and valuation adjustments. Conducting OSINT assessment during a deal's diligence period is one of the highest-value cyber due diligence activities.
What is the first step in building an OSINT capability?
Conduct a baseline OSINT assessment of your own organization. The assessment establishes what an attacker can discover about your infrastructure, employees, technology stack, and credentials using only publicly available sources. The baseline reveals immediate remediation priorities — exposed credentials in code repositories, forgotten internet-facing systems, public information that enables targeted attacks — and establishes the methodology that subsequent monitoring will use. Without the baseline, ongoing monitoring lacks the context to identify what represents new exposure versus what has always been visible.
Real-World Example: Uber Data Breach 2016 — Credentials Found on GitHub
In 2016, Uber experienced a breach that exposed data on 57 million riders and drivers. The attacker found Uber engineer credentials committed to a private GitHub repository, used those credentials to access Uber's AWS environment, and downloaded the data. The credentials were discoverable through OSINT because the repository, while private to public access, had been accessed by the attacker who had found the credentials elsewhere. The incident illustrated that code repositories — even private ones — represent significant credential exposure risk when developers commit secrets alongside code.
Of the information needed to plan a targeted cyberattack is available through open-source intelligence — meaning attackers can build detailed target profiles using only publicly available data before taking any action against the target.