What Is OSINT? The Complete Guide to Open Source Intelligence

Open source intelligence (OSINT) is intelligence produced from publicly available information that has been collected, evaluated and analyzed to answer a defined question. The operative word is intelligence. A page of search results is only information. It becomes OSINT when an investigator gathers it against a stated requirement, checks it, correlates it with other sources and turns it into an assessment that someone can act on.

What makes a source open is lawful public access, not the method used to reach it. A court filing, a company registry, a public social media profile, a domain registration record or a published dataset are all open sources. Using a paid service or a specialized platform does not change that, as long as the underlying information is lawfully available. OSINT never involves hacking, bypassing authentication, coercion or covert human sources.

OSINT is not a guarantee of truth. Open sources contain stale records, errors, deliberate disinformation and manipulated media, so every finding needs corroboration. OSINT is also more than searching. Sound open source work is methodical, source-critical and documented, and it keeps supported findings separate from possible matches and unresolved gaps. That habit, evidence before conclusions, runs through every section of this guide.

Systematic use of open sources predates the internet by decades. In 1941 the United States created the Foreign Broadcast Monitoring Service to transcribe and analyze foreign radio broadcasts; it later became the Foreign Broadcast Information Service. BBC Monitoring performed a parallel role in Britain. Analysts learned that newspapers, radio and other public material could reveal a great deal about capability and intent.

During the Cold War open sources supplemented classified collection but were often treated as secondary. That view shifted in the 1990s and changed decisively after 2001, when reviews of the US intelligence community concluded that open sources had been undervalued. The Intelligence Reform and Terrorism Prevention Act of 2004 led to a dedicated open source organization within the community in 2005.

The modern era is defined by scale. The web, social platforms, mobile devices, commercial satellite imagery and large public leaks produce more accessible data than any team can read. Investigative collaborations coordinated by the International Consortium of Investigative Journalists showed how structured analysis of massive document sets can expose hidden financial networks. The current chapter, agentic OSINT, applies AI to the same problem of volume without lowering the standard of proof.

Intelligence professionals classify collection into disciplines, the INTs, according to how information is gathered. Each discipline has distinct strengths, and serious analysis usually combines several. OSINT is the discipline concerned with publicly available sources, and it increasingly provides the context that gives the specialized disciplines their meaning.

Knowing the disciplines clarifies where OSINT stops. Open sources can show who registered a company, what a subject publishes and how a network is configured, but they cannot replace a confidential human source or an intercepted signal. The disciplines complement one another rather than compete.

Professional OSINT follows the intelligence cycle used across the wider intelligence community. The cycle imposes discipline: start from a question, collect deliberately and finish with a product rather than a folder of screenshots. It is usually drawn as five phases, though in practice they overlap and feed back into one another.

Planning and direction come first. The analyst defines the requirement, the questions to answer, the scope and the constraints, including legal and ethical limits. Clear requirements prevent the most common failure in open source work: aimless collection that produces volume without answers.

Collection gathers raw information from open sources against the plan. Processing and exploitation convert it into usable form by translating, transcribing, deduplicating and extracting entities. Analysis and production is where the analyst grades source reliability, corroborates findings, resolves contradictions and separates what is established from what is merely suggested.

Dissemination delivers the finished product to the person who needs it. Many teams lead with a BLUF, bottom line up front, so the key judgment appears before the supporting evidence and the stated limitations. Feedback then closes the loop as new questions and information gaps drive the next round of collection.

OSINT draws on an enormous range of sources, but they fall into a manageable set of categories. Knowing them helps an investigator decide where to look first and how much confidence to place in what turns up. The surface web (indexed pages), the deep web (unindexed but accessible content such as databases and records the analyst is entitled to view) and the dark web each contribute different material.

Public records and registries are among the most authoritative sources: company registries, beneficial ownership filings, court and property records, sanctions and politically exposed person lists, and professional licensing databases. Because they originate from official bodies they carry more evidentiary weight than user-generated content, though every record still needs checking against the primary source.

Technical infrastructure data is a second major category. Domain registration records, DNS, IP allocation and reputation data, TLS certificates and passive DNS history let investigators map the digital footprint of a person or organization. Breach and leak datasets form a third category. Where lawful to use, exposure records can connect an email address, username or service, provided credentials stay redacted.

The remaining categories are human and media sources. Social platforms, forums and community discussion reveal associations and behavior over time, while news archives, academic literature, patents, advertising records, public filings, offshore leak collections and, increasingly, public blockchain data provide depth and corroboration. No single category is sufficient on its own; strong OSINT triangulates across several.

Advanced search is the foundation of open source work. Search operators, sometimes called dorking, filter results by site, file type, title, URL or date and surface documents a casual query would miss. Regional and language-specific search indexes matter as well: a subject active outside the English-speaking web can be invisible to a single search engine.

Identity and infrastructure pivoting is where OSINT becomes investigative. Username discovery checks whether a handle appears across platforms, and profile enrichment compares biographies, links and photos to decide which candidates belong to the same person. WHOIS and DNS lookups show who registered a domain and how it is hosted, while reverse IP and passive DNS expose other assets on the same infrastructure. Each result is a new pivot, and each pivot needs corroboration before it becomes an association.

Media verification places and dates images and video using landmarks, shadows, signage, language and metadata, then cross-references satellite and street-level imagery. Reverse image matching finds where a picture has appeared before, and transcripts turn hours of video into searchable, citable text. Breach analysis, where legally permissible, links an identity to the services it uses and reveals the password reuse that attackers exploit through credential stuffing.

Financial and corporate tracing follows money and control. Company registries, beneficial ownership records, public filings and offshore leak collections such as the Panama Papers help unwind shell companies and nominee arrangements. Structured identifiers help too: an IBAN encodes country, bank and account, a BIC identifies the institution and an LEI uniquely identifies a legal entity. Validating an identifier confirms that it is well formed and points to the right institution. It never establishes who owns the account.

The most consequential errors in OSINT are not missed sources but overstated conclusions. A matching username is not the same person. A shared IP address is not common ownership. A name on a sanctions list is not a confirmed identity match, and a label on a wallet is not legal ownership. Experienced investigators therefore classify every result before they reason from it, and they state plainly what the evidence supports.

A useful discipline is to sort findings into four classes and keep them separate in notes, graphs and reports. The classification belongs to the analyst, not the source: the same record may be a supported finding in one investigation and a possible match in another, depending on what corroborates it. An unsuccessful search belongs in the fourth class. It records that nothing was found in the sources checked; it never establishes that information or activity is absent.

For most of its modern history OSINT has been practiced with point tools: a username checker, a WHOIS lookup, a breach search, a reverse image service, a link-analysis canvas. Each answers one narrow question well. The work of the investigation, deciding which lookups matter, running them in the right order, aligning formats and carrying results into a case, stays with the human, usually across dozens of browser tabs.

An investigative Skill is a different unit of work. It is a repeatable workflow defined by the question it answers, the evidence it delivers and the limits it states, rather than by the data source behind it. Public Profile Discovery, for example, answers the question of which public profiles are potentially associated with a person or username, and returns candidates sorted into supported associations and possible matches. A Skill is bounded on purpose: it says what it cannot establish, which is what makes its output safe to build on.

The shift from tools to Skills matters because it moves the discipline of the intelligence cycle into the workflow itself. The requirement becomes the Skill’s stated objective, collection is scoped to that objective, and the product arrives with findings, evidence and gaps already separated. Nexus organizes its capabilities this way, as 47 investigative Skills in 7 categories spanning research, identity, business and risk, media, infrastructure, Web3 and relationship analysis; the full catalog is at /skills.

Agentic OSINT is open source intelligence in which an AI agent plans and carries out multi-step investigation workflows, from source discovery through evidence retrieval, relationship analysis and reporting, against an objective the investigator defines. Cited findings link to retained source records, and a human reviews, redirects and decides. The term distinguishes this model from two alternatives: tool-based OSINT, one lookup at a time, and standalone summaries that may lack the case context and retained evidence needed for review.

The practical change is in who does the sequencing. In a conventional workflow the analyst decides that a name should lead to profile discovery, then candidate enrichment, then published contact details, then a relationship assessment, and runs each step by hand. In an agentic workflow the analyst states the objective in plain language; the agent proposes and runs the steps, retrieves the material and presents findings with citations that open to the underlying evidence. The analyst’s effort moves from operating lookups to directing the inquiry and judging what it produced.

What agentic OSINT does not change is the standard of proof. An agent can cover more sources faster than a person, but it cannot turn a possible match into a verified association; only corroborating evidence does that. A responsible agentic platform therefore reports supported findings, possible matches, contradictions and gaps as distinct classes, exposes the source behind every citation and keeps the investigator in control of every conclusion. Speed without that discipline produces confident errors at scale.

The same generation of AI also helps the adversary, since synthetic media and fabricated personas are now cheap to produce. Verification, provenance and cross-source corroboration therefore become more valuable, not less. For a fuller treatment of the model, its benefits and its limits, see the agentic OSINT guide at /agentic-osint.

Open source collection is not free of risk. Researching a subject can expose the investigator, alert the target or contaminate the case. Operational security, OPSEC, manages that exposure so collection leaves as little trace as possible and cannot be attributed to the analyst or their organization.

The most visible control is the research persona, often called a sock puppet: an account kept separate from the investigator’s real identity and used only to view public content. Sound tradecraft keeps personas consistent and non-attributable, never contacts the subject and never deceives anyone into disclosing private information, which crosses ethical and often legal lines. Technical hygiene supports the same goal: isolate research from personal and corporate systems, control the network footprint, strip metadata from anything published and keep personal logins off research infrastructure.

OSINT is lawful in principle because it relies on publicly available information, but access and use are governed separately. Visibility does not make every use legal. Data protection regimes such as the EU General Data Protection Regulation govern the processing of personal data even when it came from an open source, so investigators need a lawful basis, a defined purpose and proportionality in what they collect and retain.

Several bright lines separate OSINT from unlawful activity: accessing systems without authorization, bypassing authentication, scraping in breach of enforceable terms, pretexting to extract private information, and stalking or harassment. Breach and leak data is especially sensitive. Whether it may be used depends on jurisdiction, purpose and the investigator’s professional context, and credentials should stay redacted in every case.

Ethics reaches beyond the letter of the law. Responsible practitioners collect only what is necessary, guard against confirmation bias, weigh the harm to uninvolved third parties and document their sources so conclusions can be scrutinized. Professional licensing for investigators reinforces these standards in many countries.

When OSINT supports legal proceedings the standard rises again. Evidence must be collected and preserved so its integrity can be demonstrated later. A defensible chain of custody records what was collected, when, by whom and how it was handled, and cryptographic hashing lets a party show that a record has not been altered. ISO/IEC 27037 sets out the recognized guidelines for identifying, collecting, acquiring and preserving digital evidence; Nexus aligns its custody trail and SHA-256 hash chains with that standard.

OSINT is practiced across many professions because nearly every field benefits from a clearer picture of people, organizations and infrastructure. Private investigators use it to locate people, verify claims and trace assets. Law enforcement uses open sources for leads, victim identification and situational awareness, always within legal process. Corporate security teams assess threats to executives, facilities and brands.

In the commercial world, due diligence and know-your-customer teams screen counterparties, verify beneficial ownership and check for sanctions, politically exposed person and adverse-media exposure before entering a relationship. Fraud analysts reconstruct schemes by linking identities, accounts and devices. Threat intelligence teams research hostile infrastructure and enrich indicators of compromise. Sales and competitive intelligence teams build sourced briefs on companies and markets.

Investigative journalists use open source methods and large leaked datasets to expose hidden wealth and corruption, and human rights researchers use geolocation and imagery analysis to document events. The common thread is that every one of these practitioners answers questions with information anyone could lawfully obtain. Nexus describes how each segment applies the method, from private investigators to compliance teams, at /solutions.

Nexus is an agentic OSINT platform, an AI-powered investigation workspace that applies the method described in this guide to people, organizations, digital identities and public activity. An investigation can start in three ways: pick one of 47 investigative Skills from the Skill Library, describe the objective in your own words, or run a direct lookup. Nexus discovers sources, links cited findings to inspectable evidence, maps relationships in a case graph and keeps the investigator in control of every conclusion.

The workspace is organized around the case. Open citations to inspect retained records with available source details, and save useful findings. Agency includes relationship graphs and encrypted notes. Social discovery covers 200+ platforms. Outputs include BLUF briefs and structured PDFs from selected case records on Pro and Agency. Custody records are available when enabled at case creation; review the available trail and report before use.

Nexus reports supported findings, possible matches, contradictions and information gaps as separate classes, and an unsuccessful search is recorded as a gap rather than treated as proof of absence. Pro includes 43 of the 47 Skills and Agency includes all 47.

Start with a question, not a tool. Define what you need to know, then choose sources and methods that answer that question. Learn the fundamentals before advanced techniques: search operators, how domains and DNS work, and how to read company registries and public filings. Set up OPSEC early, with a separate research environment and non-attributable research accounts, so good habits exist before you touch a live case.

Document as you go. Record every source, timestamp and pivot so your reasoning can be retraced, and keep investigation notes that separate supported findings from possible matches and gaps. Practice on ethical targets such as your own digital footprint or public capture-the-flag exercises, then grow your method deliberately.

Expect the field to keep moving toward agentic workflows, higher evidentiary standards and stronger provenance, while synthetic media makes verification harder. The practitioners who thrive will pair AI-driven collection with rigorous method and a firm grasp of the legal and ethical limits that keep OSINT legitimate. A platform can run the steps; the judgment remains yours.