What is OSINT?
Open-source intelligence (OSINT) is intelligence built from information anyone can legally obtain: websites, news, social media, public records, published research and data that others have already collected from the internet. Open source here means openly available, not open-source software. The term comes from the intelligence community, where it sits alongside other disciplines such as human and signals intelligence.
Both sides use it. Defenders use OSINT as a free source of threat intelligence and to see how their own organization looks from outside. Attackers and penetration testers use the same sources for reconnaissance, because everything they learn about people, systems and processes makes the next step more convincing.
Common OSINT sources
| Source | What it can reveal |
|---|---|
| Company website, press releases, annual reports | Locations, partners, executives, technologies |
| Job postings | The firewall, EDR, cloud platform or database in use |
| Social media and professional networking profiles | Employee names, roles, reporting lines, email address format |
| WHOIS registration records | Who registered a domain, when, and through which registrar |
| Public DNS records and passive DNS history | Mail servers, subdomains, hosting providers |
| Certificate transparency logs | Hostnames on publicly trusted TLS certificates |
| Public code repositories | Leaked API keys, internal hostnames, configuration files |
| Breach dumps and paste sites | Valid usernames and reused passwords |
| Internet scan search engines such as Shodan and Censys | Exposed services and device banners |
OSINT as passive reconnaissance
Reconnaissance is split into passive and active. Passive reconnaissance collects information without sending traffic to the target's own systems, and most of it is OSINT. Active reconnaissance, such as ping sweeps, port scans, banner grabbing and vulnerability scans, touches the target directly and can show up in its firewall and IDS logs. Because nothing reaches the target, OSINT gathering is very hard for the target to detect.
A typical sequence before a spear phishing campaign: a job posting names the VPN product, a professional networking site lists 40 people in the finance department, a few published addresses show the format first.last@example.com, and certificate transparency logs reveal a host named vpn-old.example.com. The attacker now has targets, a believable pretext and possibly a forgotten system, without having touched the network.
How defenders use OSINT
As threat intelligence, OSINT includes community blocklists of malicious URLs and botnet servers, researcher write-ups and vendor threat reports. Analysts also pivot with it: from one malicious domain, WHOIS details, passive DNS history and certificate records often lead to many related domains the same attacker registered. The weakness is quality. Free lists are unvetted, and some include shared hosting or content delivery network addresses that would block legitimate sites, so they need checking before they drive blocking.
Defenders also run OSINT against themselves to shrink what it reveals: use registration privacy for domains, keep job postings generic about specific products, scan public repositories for leaked secrets, and train staff about what they post regarding their work.
OSINT vs. other intelligence sources
OSINT is free and public. Proprietary intelligence is a paid vendor feed with curation and context. Information shared through an ISAC comes from sector peers, often under Traffic Light Protocol restrictions, so it isn't public. Dark web monitoring searches criminal forums and marketplaces that require vetted access, and it is usually bought as a service and treated as its own source.
OSINT on the CompTIA Security+ exam
OSINT appears in two places on SY0-801. Under objective 2.1 it is a threat intelligence source: scenario wording such as "publicly available", "free" or "news, forums and social media" points to it, while "paid subscription" points to proprietary intelligence and "shared with peers in the same industry" points to an ISAC. Under objective 5.5 it is the core of passive reconnaissance in penetration testing: reading public records, searching social media or querying WHOIS is passive, while scanning, probing or connecting to the target's servers is active, even when the scan is slow and quiet. If a question asks how an attacker learned employee names and the email address format before a spear phishing campaign, OSINT is the likely answer.