Finding the Open Source Intelligence (OSINT) that affects your business or agency can help reduce your attack surface. You just have to find it first. Take a look at how OSINT works and how to secure it.

According to the Office of the Director of National Intelligence, Open Source Intelligence (OSINT) “is publicly available information appearing in print or electronic form including radio, television, newspapers, journals, the internet, commercial databases and videos, graphics and drawings.”

A Primer on OSINT

After you’ve found that OSINT exists in your business, you need to take a closer look in order to lock it down. The Open Web Application Security Project (OWASP) offers a five-step process for managing it:

  1. Find the source: Determine the source at which to look for OSINT.
  2. Harvesting: Obtain relevant data from the source you found.
  3. Data processing: Process the data obtained from the source to uncover its meaningful information.
  4. Analysis: Join that information across multiple sources.
  5. Reporting: Create a final report on what they’ve found where.

Doing this makes it easier to know what assets you have and what those devices might have access to. That includes whatever someone can find in public without digging or breaking into any networks. That might be public assets within the company or in social media posts. Look for employee posts threat actors could use for a phishing attack, documents that they could sell and/or network diagrams that attackers could use for moving within the network once they’ve gained a foothold.

Some Common OSINT Challenges

OSINT does come with certain obstacles, however. One of the greatest challenges is how personnel can collect, process and analyze relevant information without breaking privacy rules. Consider gaining the explicit consent of data subjects before doing anything with information from them.

There’s also the issue of filtering content. More tools and assets mean more data. Not all that information is useful, however. Applying content filters helps limit OSINT to only high-quality information. This requires even more efforts to collect, process and analyze relevant data.

10 OSINT Tools That Can Help

To push back against these challenges, equip teams with a lot of different tools to help them collect OSINT. Provided below are 10 tools that they might consider using. (These tools are not ranked; they are listed alphabetically.)


With BuiltWith, it’s possible to uncover the different tech stacks and platforms that power certain websites. It also generates a list of JavaScript/CSS libraries, plugins and other utilities used by the website in question. Personnel can then use that to perform vital functions, such as patching WordPress weaknesses and updating a plugin with a new version.


An OSINT tool written in Python, Creepy collects geolocation data from social networking sites as well as image hosting services. It enables users to present that data on a map. Not only that, but users can also download those results in .CSV or .KML to show in Google Maps.


theHarvester is an OSINT tool through which users can gather emails, subdomains, IPs, URLs and other pieces of data using numerous public data sources. On the passive side, theHarvester is capable of using search engines such as DuckDuckGo and Google. But it also comes with active search capabilities such as conducting DNS brute forcing and taking screenshots of whatever subdomains it finds.


A Java tool that runs on Windows-, Linux- and macOS-powered machines, Maltego is a graphical link analysis tool that helps users to gather and connect OSINT as part of an ongoing investigation. Maltego comes with 58 data integrations from over 35 data partners, and it allows users to choose four different layouts to recognize patterns in the data they’ve uncovered.


The value of Metagoofil lies in its ability to extract metadata from public documents, including PDFs and Microsoft Office files. It does this by using a Google search to find and download the documents to a local disk. At that point, the tool uses Hachoir, PdfMiner and other libraries to lift the metadata from those documents.


Recon-ng is a framework that stands apart from others due to its focus on web-based open source reconnaissance. It helps users to pursue their reconnaissance work by way of modules. Towards that end, Recon-ng comes with several built-in modules, such as those that help users to uncover further domains related to a target domain.


With Shodan, users can search the web for internet-connected devices. Websites provide some insight into those assets, but Shodan takes its scans a step further by revealing assets like Internet of Things (IoT) products. Shodan helps achieve comprehensive visibility over all a group’s devices and to keep those assets up to date.


Those running Linux- and Windows-based machines can use SpiderFoot to automate their collection of OSINT. This open source reconnaissance tool comes with over 200 modules for data collection and analysis. This can help gain a broad view of their attack surfaces, including low-hanging fruit like unmanaged assets and exposed credentials.


With more than 25 billion records stored about online assets, Spyse helps users to collect public data relating to websites, servers and devices connected on the web. Security teams can use that knowledge to check on risks and suspicious connections between those points in an effort to minimize their employer’s attack surface.


Unlike the other OSINT tools discussed thus far, TinEye focuses on reverse image searches. It can help moderate content that’s posted on the web and to detect instances of fraud involving a brand. What’s more, teams can use TinEye to track where those images are appearing online.

The Importance of Trust With OSINT

Regardless of whether they elect to work with one of the utilities discussed above or something else, security teams need to make sure they’re working with tools that they can trust. Such is the logic behind supporting the Open Cybersecurity Alliance and its work to connect the fragmented digital security landscape using agreed-upon technologies. It’s also the idea behind leveraging trusted threat hunting tools that come with over 100 Technology Alliance programs and integrations.

More from Intelligence & Analytics

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…

What Can We Learn From Recent Cyber History?

The Center for Strategic and International Studies compiled a list of significant cyber incidents dating back to 2003. Compiling attacks on government agencies, defense and high-tech companies or economic crimes with losses of more than a million dollars, this list reveals broader trends in cybersecurity for the past two decades. And, of course, there are the headline breaches and supply chain attacks to consider. Over recent years, what lessons can we learn from our recent history — and what projections…

When Logs Are Out, Enhanced Analytics Stay In

I was talking to an analyst firm the other day. They told me that a lot of organizations purchase a security information and event management (SIEM) solution and then “place it on the shelf.” “Why would they do that?” I asked. I spent the majority of my career in hardware — enterprise hardware, cloud hardware, and just recently made the jump to security software, hence my question. “Because SIEMs are hard to use. A SIEM purchase is just a checked…

4 Most Common Cyberattack Patterns from 2022

As 2022 comes to an end, cybersecurity teams globally are taking the opportunity to reflect on the past 12 months and draw whatever conclusions and insights they can about the threat landscape. It has been a challenging year for security teams. A major conflict in Europe, a persistently remote workforce and a series of large-scale cyberattacks have all but guaranteed that 2022 was far from uneventful. In this article, we’ll round up some of the most common cyberattack patterns we…