Open-source intelligence — OSINT — is information gathered from publicly available sources. For an attacker planning a social engineering campaign, OSINT is the foundation of everything that follows. The more they know about the target organisation and its people, the more convincing their pretext, the more precise their targeting, and the higher their success rate.

Understanding what OSINT reveals about your organisation is the first step in reducing your exposure to social engineering.

What OSINT is

OSINT is any information that can be obtained without breaching a system, intercepting communications, or breaking the law. It includes anything that is publicly accessible, intentionally or otherwise:

  • Public websites and social media profiles.
  • Company filings and regulatory records.
  • Domain registrations and DNS records.
  • Job adverts and recruitment pages.
  • Press releases and media coverage.
  • Conference presentations and published papers.
  • Data from historical breaches that has been publicly leaked.

The volume of information available from these sources is routinely underestimated by the organisations it relates to.

What attackers look for

An attacker gathering OSINT for a social engineering campaign is building two things: a map of the organisation and profiles of specific targets.

Organisational intelligence

Organisational structure. LinkedIn is the single richest source. It reveals who works at the organisation, their job titles, reporting lines, and how long they have been in their role. Combined with the company’s own website, this can produce a near-complete organisational chart.

Technology stack. Job adverts are remarkably detailed. An advert for a “Senior DevOps Engineer” that lists AWS, Kubernetes, Jenkins, and Terraform tells an attacker exactly what infrastructure the organisation uses. Combined with DNS records and internet-facing services, this provides a detailed technical profile.

Key suppliers and partners. Press releases, case studies, and industry directories reveal who the organisation works with. An attacker posing as a representative of a known supplier is far more convincing than one claiming to be from a company the target has never heard of.

Physical locations. Company websites, Companies House filings, and Google Maps provide addresses, building layouts (visible from street-level imagery), and in some cases, photographs of reception areas and access control systems.

Internal processes. Job adverts, employee reviews on Glassdoor, and social media posts can reveal internal processes, tools, and terminology. An attacker who uses the correct internal jargon — “Can you raise a ticket in ServiceNow?” — is much harder to identify as an outsider.

Individual intelligence

Role and responsibilities. LinkedIn profiles describe what people do in detail. An attacker targeting the IT helpdesk knows which individuals to call. An attacker targeting finance knows who processes payments.

Personal interests and habits. Social media profiles reveal hobbies, recent holidays, family events, sports teams, and other personal details. These are used to build rapport during a social engineering call or to craft a personalised phishing email.

Professional history. Previous employers, certifications, and conference presentations provide conversation topics and help the attacker build a credible pretext. “I saw your talk at [conference] — I wanted to follow up on something you mentioned” is a powerful opener.

Email format and contact details. If the organisation uses [email protected] and a few examples are publicly visible, the full email address of any employee can be derived from their name.

Credential exposure. Data from historical breaches is widely available. An attacker can check whether a target’s email address appears in any leaked datasets and, if so, what password was associated with it. If the target reuses passwords — as many people do — this provides direct access.

OSINT as a standalone assessment

Some organisations commission OSINT assessments as a standalone service, separate from a social engineering or penetration test. The objective is to understand what an attacker could learn about the organisation from public sources alone.

A standalone OSINT assessment typically produces:

  • An organisational intelligence report. What is publicly known about the organisation’s structure, technology, locations, suppliers, and processes.
  • Individual target profiles. Detailed profiles of key individuals (with the organisation’s consent), showing what an attacker could learn and how it could be used.
  • Credential exposure analysis. Which corporate email addresses appear in breach databases, and whether the associated passwords are still in use.
  • Risk assessment. An evaluation of the organisation’s overall OSINT exposure, highlighting the areas of greatest risk.
  • Recommendations. Practical steps to reduce the organisation’s digital footprint and limit the information available to attackers.

Reducing your attack surface

Complete OSINT elimination is neither practical nor desirable — organisations need a public presence. But the amount of information exposed can be reduced significantly.

Review social media policies. Employees should understand what information is appropriate to share publicly and what should remain private. Photographs of office interiors, badge designs, or internal systems are particularly risky.

Audit job adverts. Remove or limit technical detail in public-facing job descriptions. Instead of listing every technology in use, use broader descriptions or share technical details later in the recruitment process.

Limit company information disclosures. Review what information is published on the company website, in press releases, and in industry directories. Not everything that could be shared needs to be shared.

Monitor for credential exposure. Use breach monitoring services to check whether corporate email addresses appear in leaked datasets. Where they do, force password resets and ensure MFA is enforced.

Educate employees on OSINT risks. Most people do not realise how much of their online presence is visible to an attacker. Simple awareness — “here is what an attacker could learn about you from your LinkedIn profile” — can be a powerful motivator for reducing exposure.

Conduct regular OSINT assessments. The digital footprint changes over time as new content is published, new employees join, and new data is leaked. Regular assessments ensure that exposure is monitored and managed.

OSINT is the raw material of social engineering. The less an attacker can learn about your organisation from public sources, the harder it is for them to craft a convincing attack.