What is OSINT?
Definition
OSINT (open source intelligence) is intelligence built from publicly or commercially available information, such as news, websites, social media, public records and commercial databases, rather than secret sources.
- Category
- Security
- Also called
- open source intelligence, open-source intelligence
- Last updated
OSINT means collecting information that anyone can get legally and analysing it to answer a specific question. The US Intelligence Community's 2024 to 2026 OSINT strategy describes it as intelligence derived exclusively from publicly or commercially available information that addresses specific intelligence priorities, requirements or gaps. The Office of the Director of National Intelligence lists typical sources: print and electronic media such as newspapers, journals, radio, television and the internet, plus commercial databases, videos, graphics and drawings.
The key word is "intelligence". A pile of search results isn't OSINT. The work is in picking out what's relevant, checking it and connecting separate pieces into a conclusion.
Who uses it
Governments use it for national security. Security teams use it to see what an attacker could learn about their company. Journalists and investigators use it to verify events and trace people. The ODNI strategy describes OSINT as vital to the intelligence community and as something that supports its other collection methods.
Why it matters for your privacy
The same techniques work on ordinary people. A scammer who wants to sound convincing can read your social media, find your employer, look up your address on a people-search site and check which breaches your email appeared in. Each source is public. Combined, they make a profile that supports social engineering, spear phishing or doxxing.
That's why OSINT is also a way to check your own exposure. If you search for yourself the way an attacker would, you see what they see.
OSINT vs. hacking
OSINT uses information that is already out there. It doesn't involve breaking into systems. The dark web and leaked breach data sit in a grey zone: they're reachable, but how you use them matters, and the legal position depends on your country.
How to protect yourself
- 1
Search for yourself
Look up your name, email address, phone number and usernames in a search engine, and note what comes up: social profiles, old forum posts, people-search listings.
- 2
Tighten your social profiles
Make accounts private where you can, remove your employer, birthday and location from public fields, and reuse fewer usernames across sites.
- 3
Ask for removals
People-search sites and data brokers usually have an opt-out form. Google's Results about you tool covers search results that show your contact details. Serus finds where your address and phone number are listed and removes them for you.
- 4
Watch for pretexting
If someone contacts you and knows details about you, don't take that as proof of who they are. Call back using a number you looked up yourself.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is OSINT legal?
Collecting information that is genuinely public is generally lawful, but the details depend on your country. Using it to harass, stalk or defraud someone isn't, and data protection law can still apply to personal data you collect.
What are examples of OSINT sources?
News articles, websites, social media posts, public records, company registries, images and videos, and commercial databases. The ODNI includes print and electronic media and commercial databases in its list.
Is OSINT the same as hacking?
No. OSINT uses information anyone can access. Hacking means getting into systems or accounts without permission.
Sources
Something wrong or out of date? Tell us and we'll re-check it.