Open-source intelligence (OSINT) is the practice of gathering information about an organization using publicly available sources. For attackers, OSINT is the first phase of any attack. They gather information about your company, employees, infrastructure, vendors, technology stack, and decision-makers—all without accessing your systems or breaking any laws. The information they gather determines their attack strategy. They'll identify the right people to target with phishing emails, discover the tools you use and their known vulnerabilities, find employee details that enable social engineering, and map your entire infrastructure through public records. What's shocking is how much information is publicly available—and how little most organizations realize they're exposing.
The OSINT Information Gathering Process
OSINT gathering starts with corporate registrations. Attackers look up your company in state business registries to find names of founders, employees, and decision-makers. They check WHOIS records to find who registered your domain and when. They search employment sites like LinkedIn, Glassdoor, and Indeed to find your employees, their roles, technologies they use, and their personal email addresses and social media accounts. A single LinkedIn profile of a senior engineer might reveal your entire technology stack, vendor tools, cloud provider, and infrastructure architecture.
They search GitHub, Bitbucket, and GitLab for your organization's repositories and employees' personal repositories. Repositories often contain detailed information: what libraries and frameworks you use, your architecture patterns, your deployment process, and sometimes exposed credentials or internal documentation. They search StackOverflow for questions asked by your employees, which reveals technology decisions and challenges. They search Google for your company name and variations, finding press releases, archived news, former employee interviews, and technical discussions that leak information.
They monitor your public web presence: your website, blog, documentation, API documentation, and any public-facing services. They check your DNS records for historical entries using tools like SecurityTrails that track DNS changes over time. They check certificate transparency logs to find every SSL certificate you've ever issued, revealing your entire subdomain architecture. They check your CDN configuration, email servers, and any other publicly accessible infrastructure components.
They search social media for your employees, finding personal details, company information they've shared, and sometimes security information revealed accidentally. They check your job postings to understand your hiring needs and technology stack. They monitor your GitHub releases, blog posts, and technical documentation for information about your product, features, and architecture.
What Information OSINT Reveals About Your Company
OSINT gathering reveals your technology stack—every tool, framework, library, and vendor you use. This information is gold for attackers because they can research known vulnerabilities in those specific versions. If you're using WordPress 5.3 (which has known vulnerabilities), attackers will exploit those specific vulnerabilities. If you're using a specific version of Elasticsearch with authentication disabled, attackers will target that configuration. Your technology stack also reveals your technical sophistication—companies using bleeding-edge technologies are typically more security-conscious than companies using outdated frameworks.
OSINT reveals your organization structure: founders, executives, engineers, product managers, and employees in roles that make them targets for social engineering. An attacker researching your company will identify the CFO, contact them through LinkedIn, and send a well-crafted phishing email impersonating the CEO requesting a wire transfer. The success rate for these attacks is disturbingly high because the email is based on real information about your organization and your actual employees.
OSINT reveals your vendors and integrations, which becomes useful when an attacker compromises one of those vendors. If they know you use Salesforce, Stripe, Okta, and AWS, they'll target those services and attempt to compromise your accounts there. A compromised vendor account can be more valuable than compromising your infrastructure directly.
OSINT reveals historical information that shouldn't be public anymore. A GitHub repository you deleted years ago might still be cached and searchable. A press release mentioning a technology decision still appears in search results. An employee's old blog post mentioning your infrastructure details is still indexed. This historical information often contains security details you didn't mean to expose.
Tools Attackers Use to Gather OSINT
Tools like Shodan, Censys, and Zoomeye scan the entire internet for exposed services, databases, and infrastructure. You can search these tools for your company name and discover exposed services: MongoDB databases, Redis instances, Elasticsearch clusters, web servers with exposed admin panels—all publicly accessible and often with no authentication. The existence of these tools isn't secret, and neither is the information they collect. Searching for yourself is the first step to understanding what an attacker can find.
Maltego and Spiderfoot automate OSINT gathering by connecting multiple data sources: DNS records, whois information, social media profiles, GitHub repositories, employee data, and other sources. They create relationship maps showing connections between people, companies, and technologies. Shodan and similar tools identify your public infrastructure. TheHarvester finds email addresses associated with your domain. Wayback Machine shows historical versions of your website. Certificate transparency logs show your historical infrastructure.
Many of these tools are free or cheap to use. Attackers can spend 30 minutes gathering detailed information about your company without spending a dollar or breaking any laws. They learn your technology stack, find your employees, identify executives, discover your vendors, and map your infrastructure—all through publicly available information.
Reducing Your OSINT Footprint
Start by auditing what information is publicly available about your company. Search your company name on Google and browse the first 10 pages of results. Search your domain on Shodan and Censys. Check your GitHub repositories and any other code repositories. Browse your employees' LinkedIn profiles and personal GitHub accounts. This is what attackers see—and you should be alarmed at how much information is available.
Audit your DNS records and remove any that shouldn't be public. Old subdomains, staging environments, test instances—all should be removed if they're not actively needed. Check your website for exposed employee email addresses, technical details, or infrastructure information. Remove or redact sensitive details from your blog and documentation.
Implement employee OPSEC training. Employees shouldn't mention company details on social media or personal projects. Credentials should never be committed to personal GitHub repositories. Technical decisions shouldn't be discussed publicly where competitors and attackers can use that information. This isn't paranoia—it's operational security. Your employees' LinkedIn profiles are intelligence sources that attackers actively exploit.
Remove sensitive data from publicly accessible repositories. Don't document internal infrastructure details in public code repositories. Don't include vendor details, employee names, or technical architecture in accessible documentation. Lock down your GitHub repositories—make internal documentation and infrastructure discussions private.
Monitor your OSINT footprint regularly. Use the same tools attackers use to search for information about your company. Set up Google Alerts for your company name to be notified when new information appears. Check Shodan and Censys monthly for exposed infrastructure. This ongoing monitoring helps you catch information exposure before it becomes a problem.
Separating Signal from Noise
OSINT reveals a massive amount of information, but not all of it is actionable or dangerous. A GitHub repository's public dependency list reveals your technology stack, but your technology choices themselves aren't secrets—they're listed on your careers page and in your technical documentation. What matters is identifying information that reveals vulnerabilities, security configurations, or sensitive details.
Some OSINT information is stale. A press release from 2015 mentioning you used a specific framework doesn't mean you still use it. Historical information might be less valuable than current information. But historical information can still be useful for attackers—if you recently upgraded from version 2 to version 3 of a tool, version 2 might have known vulnerabilities they can exploit if any legacy instances still run.
The key security outcome from OSINT is not complete information hiding—that's impossible for any live business—but reducing unnecessary exposure. Every piece of information you don't expose is one fewer thing attackers can exploit. The strategic outcome is understanding what information is available so you can design your security posture accordingly. If attackers know your entire infrastructure from public information, you can't rely on obscurity for security.
RedRadar's OSINT security reports gather all publicly available information about your company and analyze it from an attacker's perspective, identifying what information is exposed, what vulnerabilities it reveals, and what actions to take to reduce unnecessary exposure.
Before an attacker tries to break into your systems, they spend time learning about you. They look at your public DNS records. They search certificate transparency logs for your subdomains. They check Shodan to see what ports are open on your servers. They run your domain through breach databases to find leaked employee passwords. All of this is done using publicly available information — and most companies have no idea what's out there.
What Is OSINT?
OSINT stands for Open Source Intelligence — the practice of collecting information from publicly accessible sources. In cybersecurity, OSINT means gathering everything an attacker could learn about your company without ever touching your systems. No hacking required. No laws broken. Just a systematic look at the digital footprint your company has left across the internet.
Security teams use OSINT offensively (to simulate how attackers would research a target) and defensively (to understand what's exposed before attackers find it). An OSINT security report gives you the defender's version: a comprehensive view of your public exposure, with actionable findings.
What Attackers Find via OSINT
Subdomains and Forgotten Infrastructure
Your main website is protected. But what about staging.yourcompany.com? Or dev-api.yourcompany.com? Or the old CRM you migrated away from but never decommissioned? Certificate transparency logs, DNS brute-forcing, and tools like Subfinder reveal subdomains you may have forgotten existed — many of them running outdated software with no one maintaining them.
Open Ports and Exposed Services
Shodan and Censys continuously scan the internet and index every device and service with an open port. If your database admin interface, remote desktop port, or internal dashboard is accidentally exposed to the internet, it's already in Shodan's index — and attackers search it daily.
Leaked Credentials
Data breaches at third-party services (LinkedIn, Adobe, Dropbox, and thousands of others) have leaked billions of email/password combinations. If any of your employees used their work email on a breached platform, those credentials are likely available on the dark web or paste sites. Attackers use credential stuffing — automating login attempts across your business services using these leaked pairs.
DNS Misconfigurations
Your DNS records tell attackers a lot: which email provider you use, what cloud infrastructure you're on, whether your email authentication (SPF, DMARC, DKIM) is configured. Missing or misconfigured DMARC means anyone can send spoofed emails from your domain. A dangling DNS record pointing to a decommissioned service can be hijacked.
Certificate Transparency Logs
Every SSL certificate issued for your domain is logged in public Certificate Transparency (CT) logs. This is a feature, not a bug — but it means attackers can watch CT logs for new certificates on your domain, identifying new services you've launched, internal tools you've accidentally exposed, or subdomains of interest to target.
Technology Stack Exposure
Tools like BuiltWith, Wappalyzer, and simple HTTP header inspection can identify what software your website and services are running — including version numbers. If you're running WordPress 5.8 with known CVEs, or an unpatched version of a popular framework, that information is public and searchable.
LinkedIn and Employee Enumeration
OSINT isn't just technical. LinkedIn makes it easy for attackers to enumerate your employees, identify who has admin access to your systems, and craft targeted spear-phishing attacks. "Hi Sarah, I'm from your IT department, and we need to reset your AWS credentials" — made much more convincing when the attacker knows Sarah's exact job title and who she reports to.
Real-World Consequences
These aren't theoretical risks. The 2020 Twitter hack began with a phone spear-phishing attack against Twitter employees — research that relied entirely on LinkedIn and public information. The Capital One breach stemmed from a misconfigured web application firewall on a cloud instance that was publicly enumerable. The Colonial Pipeline ransomware attack entered through a VPN account with credentials found in a previous breach.
The pattern is consistent: attackers use OSINT to find the easiest entry point, then exploit it. The entry point is almost never the one the company was worried about.
What an OSINT Security Report Covers
A professional OSINT report gives you a structured view of your external exposure:
- Subdomain enumeration — all discoverable subdomains and their current status
- Open port and service inventory — what's publicly accessible and whether it should be
- DNS health check — SPF, DKIM, DMARC, zone transfer vulnerabilities, dangling records
- SSL/TLS assessment — certificate validity, cipher strength, expiry monitoring
- Credential leak check — domain email addresses found in public breach databases
- Web application headers — missing or misconfigured security headers
- Technology fingerprinting — identified software versions and associated CVEs
- Certificate transparency monitoring — historical and recent certificates issued for your domain
Each finding comes with a severity rating and specific remediation guidance — not generic advice, but actionable steps your team can implement.
Practical Takeaways
- Assume attackers have already researched you — the question is whether you know what they found
- Subdomains are a major blind spot — audit them regularly, decommission what you don't need
- Check your domain in breach databases — Have I Been Pwned is a free starting point
- Monitor certificate transparency logs for unauthorized certificates issued for your domain
- Fix DNS misconfigurations before fixing code — they're faster to address and high-impact
- Run an OSINT audit before enterprise deals or fundraising — sophisticated counterparties will check
Want to see what attackers see when they research your company? RedRadar runs a comprehensive OSINT security scan and delivers a professional report in 24 hours — covering your full external attack surface, leaked credentials, DNS health, and more. Order your OSINT security report here →