How OSINT works
OSINT analysts gather data from open sources, including domain and certificate records, search engines, code repositories, social networks, job postings, leaked-credential reports and news. They filter and correlate the results to build a picture of people, infrastructure or events.
Defenders apply it to understand their own exposure and track threats. Attackers use the same techniques in reconnaissance, identifying staff, technologies and forgotten systems before choosing how to attack. Automation helps with volume, but analysts must validate findings to avoid acting on false or outdated information.
Why it matters for Canadian organizations
What an organization exposes publicly often determines how easily it can be targeted. Employee details on social media, exposed cloud storage and old subdomains give attackers material for convincing phishing and social engineering.
OSINT must be used lawfully. In Canada, collecting personal information is still subject to privacy law, so legitimate security work should be scoped, justified and documented. Used properly, it informs penetration testing, brand monitoring and threat intelligence. Document sources and methods so results are repeatable and defensible if they inform decisions.
How to defend against it
Review your own footprint as an attacker would. Search for exposed employees, domains, subdomains, credentials in public breaches and misconfigured cloud assets, then remove or secure what is not needed. Limit detail in job ads and public documents.
Train staff to be careful with what they share, enable monitoring for lookalike domains and leaked credentials, and feed findings into penetration test scoping and threat intelligence so defenses reflect real exposure. Review the exercise findings regularly, since public exposure changes constantly.
Frequently asked questions
Is OSINT legal?
Collecting information that is publicly available is generally lawful, but how it is used matters. Privacy law, terms of service and harassment or fraud laws can still apply, so keep work scoped and documented. Always confirm that your approach is lawful and proportionate.
How do attackers use OSINT?
They research employees, email formats, technologies and exposed systems to craft targeted phishing, guess credentials and find weak points. This reconnaissance is often the first stage of an attack. Employee names and roles are especially useful for crafting believable messages.
What tools are used for OSINT?
Common tools include search engines, Shodan-style internet scanners, WHOIS and certificate records, social media search, and frameworks that automate collection. Tool choice depends on the objective and legal scope. Dedicated frameworks can automate collection, though human analysis is still needed.
Related service: Threat intelligence