Skip to content
Lesson 1 of 8

What is OSINT and the Intelligence Cycle

7 min read

What OSINT Means

OSINT (Open Source Intelligence) is the process of collecting, evaluating, and analyzing publicly available information to turn it into actionable intelligence. The key word is "open": we are not talking about illegally accessing systems or exploiting vulnerabilities, but about leveraging data that anyone can legally consult — websites, public records, social media, code repositories, government databases, and news media.

It is important to distinguish between three concepts that are often confused. A datum is an isolated fact (an IP address, a name). Information is that datum placed in context (that IP belongs to organization X's mail server). Intelligence is information that has been processed and analyzed to answer a concrete question and support decision-making. OSINT is the set of techniques that transforms scattered public data into useful intelligence.

What makes OSINT powerful is correlation. A single datum is rarely revealing, but combining multiple public sources — a LinkedIn profile, a GitHub commit, a WHOIS record, and a geolocated photo — can reconstruct a surprisingly detailed picture. That capacity for synthesis is precisely what sets a good analyst apart from someone who merely piles up browser tabs.

The Intelligence Cycle

Professional OSINT is not random searching: it follows a structured process known as the intelligence cycle. Working methodically prevents getting lost in irrelevant data and ensures the effort serves a clear objective.

The first phase is direction (or planning): the intelligence requirements and the questions to be answered are defined. What do we need to know, and why? Without this scoping, collection becomes infinite and sterile. The second phase is collection: raw data is gathered from the selected open sources, ideally documenting each origin to guarantee traceability.

The third phase is processing: raw data is organized, translated, normalized, and filtered to make it manageable. The fourth phase is analysis: here source reliability is assessed, data is correlated, and conclusions are drawn. The final phase is dissemination: the intelligence is delivered to the recipient in a useful format — a report, a dashboard, a presentation. The cycle is iterative: dissemination usually raises new questions that restart the process.

To ground this, imagine a very concrete direction question: "What email surface does our own company example.com have exposed?". Collection would query the MX and SPF records; processing would normalize the hostnames and providers; analysis would determine whether that configuration reveals the mail provider and whether there are forgotten legacy servers; and dissemination would be a note to the systems team. The same question poorly framed — "let's find out everything about example.com" — would have generated endless noise with no conclusion.

OSINT Use Cases

OSINT has legitimate applications across many fields. In pentesting and red teaming, it constitutes the reconnaissance phase: before testing an organization's defenses, the assessor maps its exposure surface — domains, subdomains, technologies, employees, and possible leaks. The better the reconnaissance, the more realistic and useful the test.

In investigation — investigative journalism, corporate due diligence, missing-person searches, or fraud verification — OSINT makes it possible to reconstruct facts from public traces. Organizations like Bellingcat have shown how combining open sources can clarify events of international significance using only information available to anyone.

In defense and cyber intelligence (the blue team side), OSINT is used proactively: an organization applies the same techniques to itself to discover what of its information is exposed and to reduce its attack surface before an adversary does. It also feeds threat intelligence, identifying campaigns, malicious infrastructure, and credential leaks.

Anatomy of a Correlation

Bellingcat's public investigations popularized a method worth dissecting, because it illustrates the essence of OSINT: each source is weak on its own, but strong in combination. Suppose a legitimate verification case — confirming where and when a video was filmed that an organization claims to have shot at its headquarters.

  • A frame shows a building with a partially visible sign → reverse image search suggests a city.
  • The shadow of a lamppost falls to the northeast → a solar calculation tool narrows the time window and season.
  • The background matches a Street View shot of that street → the exact location is confirmed.
  • The metadata of an attached document (Lesson 6) indicates the creation date → the timeline is corroborated.

None of those pieces proves anything on its own. Their convergence — four independent sources pointing to the same place and moment — is what produces a solid conclusion. That is the mental pattern we will repeat throughout the course.

A First Practical Workflow

Before getting into dedicated tools, it helps to see that many basic OSINT queries are done with utilities any system already ships. All of the following are queries to sources that are public by design (the domain name system) and are perfectly legal:

# Who registered the domain and when? (public domain record)
whois example.com

# What IP does it resolve to? (A record)
dig +short example.com A

# What mail servers does it use? (MX record)
dig +short example.com MX

# What mail policy/services does it declare? (TXT records: SPF, verifications)
dig +short example.com TXT

With just these four commands you already get an initial picture: the domain's age, where it is hosted, and which mail provider it uses. Run against your own domain, they are also the first step of a defensive audit. We will explore each one in Lesson 4.

Investigator OPSEC from Day One

Beginners tend to focus on the target and forget that their own activity leaves a trace. From the very first query it is worth adopting two habits we will develop in Lesson 8:

  • Separate identities. Never use your personal accounts to investigate. Visiting a LinkedIn profile from your real account can notify the target. Use dedicated, credible research accounts, always within the terms of service.
  • Prefer passive. Querying third-party sources (search engines, historical archives, passive DNS databases) does not touch the target's infrastructure and leaves no trace in its logs. Reserve active techniques for when they are necessary and authorized.

Principles and Limits

Effective OSINT rests on a few principles. Verification is essential: open sources contain errors, disinformation, and outdated data, so every conclusion must be corroborated with independent sources. Traceability ensures that each finding can be reproduced and audited. And bias management prevents the analyst from seeing only what they expect to find.

There is also a fundamental limit that will run through the entire course: OSINT works exclusively with legitimately public sources. The moment systems are accessed without authorization, stolen credentials are used, or a person's privacy is violated, we are no longer talking about OSINT but about unlawful activity. Keeping that line clear is not just a legal matter — it is the foundation of any investigator's professional credibility.

Closing Best Practices

  • Define the question before touching the keyboard: without a clear requirement, there is no efficient collection.
  • Document every source with its URL, date, and confidence level from minute one.
  • Seek independent corroboration before treating any finding as confirmed.
  • Always distinguish datum, information, and intelligence: do not deliver raw data as if it were conclusions.
  • Apply basic OPSEC (separate identities, passive sources) even when the target is yourself.
  • When in doubt about the legality of an action, stop and consult: no technique justifies crossing the line.