Thinking Like an Intelligence Analyst: Skills, Disciplines, the Layers of the Web and the OSINT Workstation

Two analysts can use exactly the same tools and produce completely different results. One delivers a sharp, defensible assessment. The other delivers a pile of screenshots. The difference is rarely the software. It is the way the analyst thinks, the context they understand and the discipline with which they prepare their working environment.

Part 2 of The Ultimate OSINT Cheat Sheet covers exactly that: the key skills of an intelligence analyst, the intelligence disciplines around OSINT, the categories of the internet and how to optimise your computer and browser for investigations. This article unpacks each block.

At Cibergy, an intelligence and fraud consulting firm, we tell you everything you need to know about how to think like an intelligence analyst, step by step.

The five key skills of an intelligence analyst

1. Critical thinking. Evaluate every piece of information for reliability, relevance and implications. Who published it? Why? When? Could it be satire, a copy, an old photo recirculated? Critical thinking is also about challenging your own hypotheses. Confirmation bias is the silent killer of investigations: once we believe something, we tend to find only what supports it.
2. Research and analysis. Gather information from a variety of sources and draw conclusions from data sets. Good researchers are persistent and creative: they try the alternative spelling, the old username, the regional search engine. Good analysts then step back and ask what the findings actually mean.
3. Technical skills. Proficiency with analytical tools, databases and data collection software. You do not need to be a programmer, but understanding how websites, metadata, APIs and search indexes work will make you much more effective. Basic scripting and spreadsheet skills pay off quickly.
4. Problem-solving. Investigations rarely go in a straight line. Accounts are private, websites are down, the target uses a pseudonym. Creative and strategic problem-solving means finding the alternative pivot: the tagged friend, the cached version, the company registry entry.
5. Communication skills. An insight nobody understands is worthless. Analysts must convey findings clearly in written reports and oral briefings, with the bottom line up front and a clear distinction between facts and assessments.

If you are hiring for an OSINT team, notice that only one of the five is technical. The others are habits of mind that can be trained but take time to mature.

OSINT and its sister disciplines

OSINT is one of several intelligence analysis disciplines (often called the INTs). Understanding the others helps you know where OSINT ends and where it can complement other collection methods.

In practice the boundaries blur. Geolocating a public photo uses OSINT sources with GEOINT techniques. Analysing a public network of accounts is SOCMINT. And publicly available satellite imagery has turned many former IMINT tasks into everyday OSINT work.

One line is worth drawing clearly for private-sector practitioners: HUMINT and SIGINT activities are heavily regulated. Talking to people under false pretences or intercepting communications can be illegal outside of authorised government or law enforcement contexts. Know your legal framework before you mix disciplines.

Surface, deep and dark web

The internet is often described in three layers, or internet categories, and the terms are frequently misused.

• Surface web. The part of the web indexed by search engines and visible to everyone. Commonly cited estimates put it at only a small fraction of all online content (the figure of around 4% is often quoted, though no one can measure it precisely). The point stands: if you only use Google, you are only seeing the tip of the iceberg.
• Deep web. Content not indexed by search engines. This is not sinister. It includes databases, records behind search forms, cloud storage, webmail, intranets and anything behind a login. Much of the most valuable OSINT lives here: company registries, court databases, property records and archives that you must query directly.
• Dark web. Networks such as Tor that require specific software and are designed for anonymity. Some legitimate users rely on it to avoid censorship and surveillance, but it is also home to illegal markets, leak sites and criminal forums. For OSINT practitioners it is relevant for threat intelligence, data leak monitoring and fraud investigations, and it demands strict operational security.

The practical lesson: “deep web” research is everyday OSINT. Learning which specialised databases exist for each country and topic is one of the most valuable investments an analyst can make.

Optimising your computer for investigations

Your workstation is part of your methodology. The cheat sheet lists five building blocks for computer optimization.

1. Antivirus. Investigations take you to suspicious websites, downloads and documents. Keep endpoint protection active and updated (Windows Defender, ClamAV, Avast and similar).
2. VPN. A Virtual Private Network encrypts your traffic and masks your IP address from the sites you visit. Providers such as ProtonVPN or NordVPN are common choices. A VPN is not anonymity on its own, but it avoids exposing your organisation’s IP to a target.
3. Virtual machines. Run investigations in a separate, disposable environment. Purpose-built distributions include Kali Linux, Trace Labs OSINT VM, Tsurugi and Silo (a managed browser platform for isolated online investigations). If a VM gets compromised or contaminated with cookies and trackers, you simply revert to a clean snapshot.
4. Web browsers. The browser is your primary tool. Many analysts use different browsers for different purposes: a hardened Firefox or Brave for general research, Tor Browser for .onion sites, and a separate profile for each investigation so cookies and logins never mix.
5. Sock puppets. Fictitious online identities used to access content that requires an account without exposing your real identity. Tools like fake name generators and AI-generated faces (ThisPersonDoesNotExist, generative AI) help build them. Use them responsibly: respect platform terms and the law, never use them to deceive people into revealing private information, and document their use in line with your organisation’s policies.

Fourteen browser extensions worth knowing

Extensions turn a normal browser into an investigation workstation. The cheat sheet highlights these:

• Privacy and hygiene: uBlock Origin (blocks ads and trackers), Privacy Badger (blocks invisible trackers), Cookie AutoDelete (clears cookies when you close tabs), User-Agent Switcher (changes how your browser identifies itself).
• Images and metadata: Exif Viewer (shows photo metadata), RevEye (reverse image search across several engines at once).
• Archives and capture: Wayback Machine (check and save archived versions), FireShot (full-page screenshots), Forensic OSINT (documented captures), Vortimo (records and organises what you browse), DownThemAll (bulk downloads).
• Infrastructure and context: Shodan (shows exposed services for the site you are visiting), Google Translate (instant translation), Sputnik (sends IPs, domains and hashes to multiple lookup services).

Two caveats. First, every extension you install can read what you browse, so keep the list short and install only from trusted sources. Second, browser platforms change: Chrome’s move to Manifest V3, for example, limited what the classic uBlock Origin can do on Chromium browsers, while it still works fully on Firefox. Review your extension stack regularly.

Putting it together

A well-prepared intelligence analyst starts each case with a clean VM snapshot, a dedicated browser profile, a VPN, the right extensions and, if needed, an approved sock puppet. They know which INT they are working in and where the legal limits are. And they approach every finding with the critical mindset that turns data into intelligence.

In Part 3 we focus on the analyst’s most-used tool of all: search engines, and the operators that make them far more powerful.

Want to go deeper? Download the full OSINT Cheat Sheets collection and explore the training programmes at OSINT Excellence, or contact Cibergy for professional open source investigations.

Frequently asked questions (FAQs)

What skills does an intelligence analyst need?

An intelligence analyst needs five skills: critical thinking, research and analysis, technical skills, problem-solving and communication. Only one of the five is technical. The others are habits of mind that can be trained but take time to mature.

What does critical thinking mean in intelligence analysis?

Critical thinking means evaluating every piece of information for reliability, relevance and implications: who published it, why, when, and whether it could be satire, a copy or an old photo recirculated. It also means challenging your own hypotheses, because confirmation bias leads investigators to find only what supports what they already believe.

What are the main intelligence disciplines?

Six disciplines are usually called the INTs: OSINT (open source intelligence), SOCMINT (social media intelligence), HUMINT (human intelligence), GEOINT (geospatial intelligence), IMINT (imagery intelligence) and SIGINT (signals intelligence). In practice the boundaries blur, for example when geolocating a public photo combines OSINT sources with GEOINT techniques.

Why are HUMINT and SIGINT regulated for private-sector practitioners?

HUMINT and SIGINT are heavily regulated because talking to people under false pretences or intercepting communications can be illegal outside authorised government or law enforcement contexts. Private-sector practitioners should know their legal framework before mixing disciplines.

What is the difference between the surface web, the deep web and the dark web?

The surface web is the part indexed by search engines and visible to everyone. The deep web is content not indexed by search engines, such as databases, cloud storage, webmail and anything behind a login, and it holds much of the most valuable OSINT. The dark web is made up of networks such as Tor, designed for anonymity, and demands strict operational security.

How should an analyst set up a computer for investigations?

A well-prepared setup combines five building blocks: antivirus, a VPN, virtual machines, separate browsers or profiles, and, if needed, an approved sock puppet. Each case should start from a clean VM snapshot and a dedicated browser profile, so cookies and logins never mix.

Which browser extensions are useful for OSINT investigations?

The cheat sheet highlights fourteen extensions grouped by use: privacy and hygiene (uBlock Origin, Privacy Badger, Cookie AutoDelete, User-Agent Switcher), images and metadata (Exif Viewer, RevEye), archives and capture (Wayback Machine, FireShot, Forensic OSINT, Vortimo, DownThemAll) and infrastructure and context (Shodan, Google Translate, Sputnik). Because every extension can read what you browse, the list should stay short and come from trusted sources.

Summary

Thinking like an intelligence analyst matters as much as the tools you use. Five skills, from critical thinking to communication, separate a defensible assessment from a pile of screenshots, and only one of them is technical. OSINT sits alongside SOCMINT, HUMINT, GEOINT, IMINT and SIGINT, and the legal limits on HUMINT and SIGINT are worth drawing clearly. The surface, deep and dark web describe three categories of the internet, with the deep web holding much of the most valuable OSINT. A clean VM snapshot, a dedicated browser profile, a VPN, a short list of extensions and, if needed, an approved sock puppet complete the intelligence analyst’s workstation.

• Five skills: critical thinking, research and analysis, technical skills, problem-solving and communication; only the third is technical.
• Six INTs: OSINT, SOCMINT, HUMINT, GEOINT, IMINT and SIGINT, with HUMINT and SIGINT heavily regulated.
• Three internet categories: the surface web is indexed, the deep web is not, and the dark web needs software such as Tor.
• Deep web research is everyday OSINT: company registries, court databases, property records and archives.
• Five workstation blocks: antivirus, VPN, virtual machines, web browsers and sock puppets.
• Fourteen extensions cover privacy, images and metadata, archives and capture, and infrastructure and context.
• Sock puppets must respect platform terms and the law, and never be used to deceive people into revealing private information.