---
{
  "title": "Open-source intelligence",
  "summary": "Analyze publicly accessible information with source and privacy discipline.",
  "topic": "soc",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    5
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Technical Guide to Information Security Testing and Assessment",
      "url": "https://csrc.nist.gov/pubs/sp/800/115/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## Public information becomes intelligence through analysis

Open-source intelligence, or OSINT, uses publicly accessible information to answer a defined question. Sources can include official publications, public websites, domain records, public code repositories, and openly shared reporting. The intelligence comes from evaluating and interpreting the material, not simply collecting a large list of links.

Public accessibility does not remove the need for authorization, privacy discipline, or careful handling. Research about an organization should stay within the agreed scope. Avoid collecting personal details that do not serve the question, and do not treat an exposed credential as permission to use it.

## Research a fictional exposure question

An academy asks whether its public technical material reveals outdated contact information or unnecessary infrastructure details. The researcher defines the approved domains and repositories, records the research dates, and examines material without attempting to bypass access controls.

A public document names an old support server. That is a finding about the document's contents. It does not establish that the server still exists, is reachable, or is vulnerable. Those stronger questions may require a separately authorized technical assessment.

The researcher traces the document to its original publisher and checks whether a newer version supersedes it. A cached copy or third-party mirror can preserve useful history, but its date and completeness may differ from the current source.

## Evaluate provenance and uncertainty

Keep the original source location, publication or capture date where available, and the reason the material is relevant. Screenshots can support documentation, but they should be accompanied by context rather than treated as self-explanatory evidence.

Cross-check important claims through independent sources. Several websites repeating the same announcement do not provide independent confirmation. [[source-evaluation]] helps distinguish firsthand material, credible reporting, inference, and rumor.

Information can be accurate yet misleading when removed from context. A public username might refer to a different person, and a domain registration detail might describe a privacy service. Avoid turning a tentative association into a confident identity claim.

## Produce a decision-focused result

A useful OSINT report explains what was found, why it matters to the original question, what could not be established, and which owner should review it. It should not overwhelm readers with every unrelated item encountered during research.

For practice, choose a fictional organization's public documentation and define three narrow questions. Record only evidence relevant to those questions, then label each conclusion as directly supported or inferred. Propose a harmless corrective action, such as updating a public contact page, rather than escalating a speculative technical claim.

Connect the work to [[reconnaissance]] when learning assessment methods and to [[threat-intelligence]] when public reporting informs defensive decisions. The scope and purpose determine the appropriate use.

## Related concepts

- [[intelligence-cycle]]