What is OPSEC?
OPSEC, short for operations security and often called operational security, is the discipline of denying adversaries the information they need to plan an attack. Most of that information is not secret by itself: a badge photo, a job ad naming a firewall product, an executive's conference schedule. OPSEC starts from the fact that harmless-looking details can be pieced together, and it asks people and organizations to think about what they reveal before they reveal it.
Where OPSEC comes from
The term comes from the U.S. military, which formalized it during the Vietnam War after finding that opponents could predict operations from unclassified clues. U.S. government OPSEC programs follow a five-step process: identify critical information, analyze threats, analyze vulnerabilities, assess risk, and apply countermeasures. The same reasoning works for any organization.
What employees should not share publicly
- Photos showing badges, screens, whiteboards or secure areas
- Org charts and who approves payments, which make BEC pretexts convincing
- Executives' travel dates, which make an urgent request from abroad believable
- Internal project names, suppliers and specific security products
- Automatic out-of-office replies that give anyone who writes a delegate's name, a mobile number and a return date
OPSEC in practice
For an organization, OPSEC means reviewing what it publishes: keeping job ads generic about security tooling, using domain registration privacy, trimming external out-of-office detail, and checking photos before they go on social media. Security teams can run OSINT against their own company to see what an attacker would find. Analysts researching threats need OPSEC as well, since browsing criminal forums from a corporate laptop or a traceable account can expose both the investigator and the employer.
Example scenario
A company announces that its CFO will speak at a conference overseas next week. During that week, accounts payable receives an email from a lookalike domain, signed with the CFO's name, asking for an urgent wire to close a deal while she is traveling. The public announcement is what made the request plausible. An OPSEC review would have delayed the announcement or briefed finance to expect exactly this lure.
OPSEC vs. situational awareness
The two appear side by side in awareness training and are easy to mix up. Situational awareness is noticing what is happening around you: a tailgater, a shoulder surfer, an MFA prompt you did not start. OPSEC is controlling what you give away. A simple test is direction: watching for threats coming in is situational awareness; limiting information going out is OPSEC.
OPSEC on the CompTIA Security+ exam
Operational security is one of the awareness training topics under SY0-801 objective 5.6. Scenario clues include employees posting badge photos or travel plans, job ads that name exact security products, or detailed out-of-office replies. The fix is training on what not to publish plus a review of public content. Distractors are situational awareness (noticing suspicious activity nearby), a clean desk policy (papers and screens at the workstation) and data loss prevention, a technical control for sensitive data leaving systems rather than everyday public details.