Every day, people and organisations publish an extraordinary amount of information about themselves. Company filings, social media posts, news articles, conference programmes, job adverts, photos with metadata, domain registrations. Most of it is noise. Some of it is exactly what an investigator, an analyst or a security team needs to make a better decision.
Open Source Intelligence, or OSINT, is the discipline of turning that public noise into usable intelligence. This article expands on Part 1 of The Ultimate OSINT Cheat Sheet and covers the OSINT fundamentals: what OSINT is (and isn’t), the intelligence cycle, the main source families, who uses OSINT and why, and a starter kit of free tools.
At Cibergy, an intelligence and fraud consulting firm, we tell you everything you need to know about the fundamentals of OSINT, step by step.
What OSINT is, and what it is not
In simple terms, what is OSINT? OSINT is the practice of collecting and analysing information from publicly available sources to gather insights, identify trends or generate intelligence.
Two words in that definition do the heavy lifting.
Publicly available means information anyone could lawfully access: open websites, public registries, published reports, public social media content, broadcast media. It does not mean hacking into accounts, buying stolen databases or tricking someone into revealing private data. The moment you cross that line you are no longer doing OSINT, and you are likely creating legal and ethical problems for yourself and your client.
Intelligence is the other key word. A list of 200 links about a person is not intelligence. A one-page assessment that says this supplier’s director also controls two dissolved companies with unpaid debts, which raises the risk of the contract is intelligence. The difference is analysis: relevance, context and a clear answer to a question someone actually asked.
This is why experienced practitioners say that OSINT is 20% finding information and 80% knowing what to do with it.
The intelligence cycle: a method, not a checklist
Good OSINT work follows a structured process, the OSINT intelligence cycle. The cheat sheet summarises it as a five-step cycle:
- Planning and direction. Define the question, the scope, the deadline and the constraints. Who is the customer of this intelligence? What decision will they make with it? What is out of bounds legally or ethically?
- Collection. Gather information from relevant sources, using a mix of manual techniques and technological resources. Collection should be driven by the plan, not by curiosity.
- Processing. Organise, translate, deduplicate, verify and archive what you collected. Capture URLs, timestamps and screenshots so findings can be reproduced and defended later.
- Analysis and production. Determine relevance, connect the dots, assess reliability, anticipate outcomes and evaluate the impact on your client’s interests. Then write it up.
- Dissemination. Deliver the product to the decision-maker in a format they can use, collect feedback, and restart the cycle as needed.
The word cycle matters. Feedback from the decision-maker almost always generates new questions. A due diligence report may reveal an unexpected link to a third company, which becomes the starting point of a new collection round.
Practical tip: the most common mistake beginners make is to skip step 1 and jump straight into Google. Ten minutes spent writing down the exact intelligence requirement (“Is there any public evidence that the claimant has been physically active since the accident date?”) will save hours of unfocused browsing.
The top source families
The cheat sheet groups the main OSINT sources into six source families. Each has its own strengths and pitfalls.
- People identifiers. Names, aliases, usernames, email addresses, phone numbers, employment history and education. These are the pivots of most investigations. One email address can lead to a username, which leads to a forgotten forum profile, which leads to a photo, which leads to a location.
- Social media platforms. Facebook, X (formerly Twitter), Instagram, LinkedIn, TikTok and many regional networks. They reveal relationships, routines, opinions and images. They are also the most volatile source: content disappears, accounts go private, and platforms change their search features constantly. Capture what you find as soon as you find it.
- News articles. Traditional news websites, digital newspapers and local press. Local media is often underrated. A small regional outlet may be the only source that covered a court case, a business opening or a local dispute.
- Reports. Documents, white papers, statistical data and official publications from governments and organisations. Annual reports, regulatory filings and procurement records are gold for corporate investigations.
- Websites. Text, images, videos, documents and, critically, metadata. A company website can reveal staff names, office locations, technology providers and historic versions of itself through web archives.
- Blogs and forums. User-generated content across every imaginable niche. Forums are where people speak more freely than on mainstream social media, and where usernames are often reused for years.
A useful habit is to ask, for every investigation: which of these six families have I not checked yet? Gaps in coverage are often where the key finding hides.
Six purposes of OSINT
OSINT is not a single job, and the purposes of OSINT vary widely. The same techniques serve very different objectives:
- Security and threat intelligence: identifying risks to people, facilities or organisations by analysing public information.
- Investigations: supporting fraud, insurance, legal, HR or criminal inquiries with relevant facts.
- Competitive intelligence: understanding competitors, market trends and customer preferences.
- Reputation management: monitoring how individuals, organisations and brands are perceived online.
- Journalism and research: uncovering facts, verifying claims and providing context.
- Disaster response and crises: assessing the impact of natural disasters, conflicts or crises to support an effective response.
Understanding the purpose shapes everything else: the sources you prioritise, the level of evidence you need and how you present your conclusions.
Who uses OSINT
The cheat sheet identifies four main groups of people who use OSINT.
- Governments use OSINT for community sentiment analysis, risks and threats to public safety, weather and natural disasters, trending activities and critical information.
- Corporations use it for personal protection and screening, due diligence, fraud investigations, supply chain risk, asset protection and brand monitoring.
- Law enforcement agencies apply it to crisis response, countering violent extremism, situational awareness, public safety and in-depth investigations.
- Investigators and journalists rely on it for verification, investigative journalism, private investigation, uncovering facts and accessing data that would otherwise remain scattered.
- If you are building a career in OSINT, it is worth noticing that the core skill set is shared across all four groups. What changes is the legal framework, the evidentiary standard and the type of question you are asked.
A starter kit of free tools
You do not need an expensive platform to start doing serious OSINT. The cheat sheet highlights eight free OSINT tools that cover a surprising amount of ground:
| Tool | What it helps you do |
|---|---|
| Web Archive (Wayback Machine) | See previous versions of websites and recover deleted pages |
| Epieos | Check what public accounts and information are linked to an email address or phone number |
| IntelTechniques tools | Use Michael Bazzell’s search tool pages to query many sources from one place |
| Forensic OSINT | Capture web pages and social media content in a forensically documented way |
| Have I Been Pwned | Check whether an email address appears in known data breaches |
| Namechk | Check whether a username is registered across dozens of platforms |
| FOCA | Extract metadata (authors, software, internal paths) from public documents |
| OpenCorporates | Search one of the largest open databases of companies worldwide |
Tool availability changes quickly in OSINT: services are shut down, go behind paywalls or change their features. Treat any tool list as a starting point and verify what still works before relying on it in a live case.
Five habits that separate good OSINT from Googling
- Start with a question, not a search. Write the intelligence requirement down.
- Document as you go. URL, date, time and a capture for every relevant finding.
- Corroborate. One source is a lead, two independent sources is a finding.
- Separate fact from assessment. Make clear in your report what you found and what you conclude from it.
- Respect the law and your own operational security. Only public information, collected in a way you could explain in court.
Final thoughts
OSINT is often presented as a collection of clever tools and tricks. Tools matter, but the OSINT fundamentals matter more: a clear requirement, a disciplined process, broad source coverage and honest analysis. Master those and every new tool simply makes you faster.
In Part 2 of the series we look at the skills of an intelligence analyst, the different intelligence disciplines, the layers of the internet and how to set up a computer for investigations.
Want to go deeper? Download the full OSINT Cheat Sheets collection and explore the training programmes at OSINT Excellence, or contact Cibergy for professional open source investigations.
Frequently asked questions (FAQs)
What is OSINT?
The practice of collecting and analysing information from publicly available sources to gather insights, identify trends or generate intelligence. Publicly available means information anyone could lawfully access, such as open websites, public registries, published reports, public social media content and broadcast media. Hacking into accounts, buying stolen databases or tricking someone into revealing private data is not OSINT.
What are the five steps of the intelligence cycle?
Planning and direction, collection, processing, analysis and production, and dissemination. Feedback from the decision-maker usually generates new questions, so the cycle restarts as needed.
What is the difference between information and intelligence?
A list of 200 links about a person is information. Intelligence is a one-page assessment that answers a question someone actually asked, with relevance and context. Analysis makes the difference, which is why OSINT is often described as 20% finding information and 80% knowing what to do with it.
What are the main OSINT source families?
Six: people identifiers, social media platforms, news articles, reports, websites, and blogs and forums. Each has its own strengths and pitfalls, and checking which families remain unchecked often reveals where the key finding hides.
Who uses OSINT?
Four main groups: governments, corporations, law enforcement agencies, and investigators and journalists. The core skill set is shared across all of them, while the legal framework, the evidentiary standard and the type of question change.
Which free OSINT tools are worth starting with?
The cheat sheet highlights eight: Web Archive (Wayback Machine), Epieos, IntelTechniques tools, Forensic OSINT, Have I Been Pwned, Namechk, FOCA and OpenCorporates. Tool availability changes quickly, so verify what still works before relying on any of them in a live case.
What habits separate good OSINT from simply googling?
Start with a question rather than a search, document every finding with URL, date, time and a capture, corroborate with two independent sources, separate fact from assessment, and respect the law and your own operational security.
Summary
The OSINT fundamentals come down to turning publicly available information into intelligence through analysis. Following the five-step intelligence cycle, from planning and direction to dissemination, keeps the work focused on a real question. Six source families, from people identifiers to blogs and forums, and six purposes, from security and threat intelligence to disaster response, show how broad the discipline is, while governments, corporations, law enforcement, and investigators and journalists all rely on it. A starter kit of free tools and five simple habits are enough to begin, and the foundations matter more than any single tool.
- OSINT is the collection and analysis of publicly available information; analysis is what turns it into intelligence.
- The intelligence cycle has five steps: planning and direction, collection, processing, analysis and production, and dissemination.
- Six source families cover most investigations: people identifiers, social media, news, reports, websites, and blogs and forums.
- Six purposes range from security and threat intelligence to disaster response and crises.
- Four user groups rely on it: governments, corporations, law enforcement, and investigators and journalists.
- Free tools such as the Wayback Machine, Epieos and OpenCorporates are enough to start, as long as you verify what still works.
- Five habits separate good OSINT from Googling: a clear question, documentation, corroboration, separating fact from assessment, and respect for the law.
