What Is OSINT (Open-Source Intelligence)?
OSINT — open-source intelligence — is intelligence gathered entirely from publicly available sources. No hacking, no privileged access: just the disciplined collection and correlation of information that is already out in the open. It is the reconnaissance stage of most attacks, a core skill in penetration testing, and a defensive tool for understanding your own exposure.
What does OSINT draw on?#
The raw material is everywhere, which is exactly the point:
- The organization — websites, job postings (which reveal tech stacks), press releases.
- Technical footprint — DNS records, WHOIS, certificate transparency logs, exposed services.
- People — social media, conference talks, public code commits.
- Leaks — credentials from past breaches, documents in public buckets.
Individually harmless, these fragments combine into a detailed picture — the first step of the Cyber Kill Chain and a favorite input for social engineering.
How do attackers and defenders both use it?#
| Attacker use | Defender use |
|---|---|
| Map the attack surface | Discover your own exposed assets |
| Craft convincing phishing | Find leaked credentials before attackers do |
| Find employees to target | Monitor brand and executive exposure |
The same techniques serve both sides — which is why defenders should OSINT themselves regularly.
OSINT is where reconnaissance begins. For a hands-on start, see OSINT for beginners. More at the Security Fundamentals hub.
Frequently asked questions#
What counts as OSINT?
Any intelligence drawn from publicly available sources: websites, social media, public records, DNS and WHOIS data, code repositories, job postings, leaked databases, and search engines. The defining trait is that no privileged access is needed — everything is already public, just scattered until someone assembles it.
Is OSINT legal?
Gathering information that is genuinely public is generally legal, and it is a standard part of authorized penetration tests and defensive work. What crosses lines is acting on it — using found credentials to log in, or accessing systems without permission. OSINT gathers; authorization governs what you may do next.