Open source intelligence collects and analyzes information that is already public in order to understand exposure, threats, or targets.
The sources are visible without breaking into a system, which is what separates this work from an intrusion.
How it works
Defenders use public pages, records, and posts to see which staff names, documents, and technical details their organization has already revealed.
Attackers use the same public material to choose a person, mimic a writing style, or find a system the organization did not mean to advertise.
The value and the risk come from aggregation: one harmless page becomes sensitive when it is combined with several others.
This page does not list collection steps or favored sources, because the protective point is to reduce what is public and to treat public data as something adversaries can read.
Concrete examples
- A recruiter post names an internal tool and a team structure that later appears in a convincing approach to an employee.
- A forgotten subdomain still serves a login page that search results reveal long after the project ended.
- Photos of badges at a conference show enough detail that a visitor could mimic the layout on a fake badge.
Protective measures
- Review public job posts, documents, and status pages for internal names and system details before they go out.
- Remove or lock forgotten sites that still appear in public search results.
- Teach staff that conference badges, office photos, and personal posts can be read by anyone planning a lure.
- Use public information to find your own exposure on a schedule, and track what you managed to take down.
Related articles
Crime that misuses personal details, sometimes first seen in public, is explained in What is identity theft against an individual private person?.
A public facing loyalty figure that scripted feedback can distort is described in What is the Net Promoter Score in customer feedback programs?.
How teams name categories before they analyze events is covered in What is label engineering for security data and detection models?.