OSINT specialties

OSINT specialist areas

Social Media intelligence

Social Media Intelligence refers to information collection about a group, organization or phenomenon through the social networking platforms.

Facebook, Twitter, LinkedIn, Instagram: Social media are everywhere, and can offer a wealth of information about organizations, products and people. Social media researchers analyze users, groups, communities, and conversations, and can look at the metadata, patterns, and social signals they create, depending on the investigation.

OSINT researchers that specialize in Social Media often have access to dozens of different Social Media platforms. Some researchers specialize in big data and social media, while others specialize in just one platform, keeping up with the latest features, and are able to find details that others cannot.

One area where social media intelligence is often used, is in risk assessments, where researchers create risk profiles for publicly exposed persons (PEPs).

Another area where social media intelligence is used is attribution: in this area, researchers reveal what party is behind certain social media campaigns (threats, slander campaigns, troll factories, or misinformation campaigns). In some cases, researchers work together with behavioral analysts to gain more insight into the seriousness and motivation of the threat.

Social media nowadays does not only involve the popular website like Facebook, Twitter, LinkedIn, Instagram, Reddit or YouTube: for OSINT specialists, it also means services like Whatsapp, Telegram, Signal, Snapchat, Tiktok, and dozens if not hundreds of others.

Social media OSINT researchers can specialize in the following areas:

  • Social Networks: Facebook, Twitter, LinkedIn, ..
  • Chat apps: Whatsapp, Telegram, Signal, ..
  • Media Sharing Networks: Instagram, Snapchat, YouTube, ..
  • Discussion Forums: Reddit, Quora, Digg, ..
  • Bookmarking & Content Curation Networks: Pinterest, Flipboard, ..
  • Consumer Review Networks: Yelp, Zomato, TripAdvisor, ..
  • Blogging & Publishing Networks: WordPress, Tumblr, Medium, ..
  • Social Shopping Networks: Polyvore, Etsy, Fancy, ..
  • Interest-Based Networks: Goodreads, Houzz, Last.fm, ..

For more information about social media intelligence, check out the Wikipedia entry.

Corporate OSINT

Corporate OSINT is a favorite amongst corporations that want to know more about potential customers, trade partners or perform a competitor analysis. Researchers will look beyond standard resources like the official registers, to get a better picture of an organization/competitor, and verify existing information. By combining internet sources, registries, and information brokers, researchers can often quickly provide answers regarding reliability, ownership, reputation and infrastructure.

Typical corporate OSINT cases are:

  • Competitive intelligence

    Competitive intelligence is used to support executives in making strategic decisions for their organization. OSINT specialists collect, analyze, and distribute intelligence about competitors, products, customers, and other relevant issues. This enables the organization to learn as much as possible, as soon as possible, what is happening in the world outside the organization.

    Results of the competitive intelligence process allow for early identification of risks and opportunities in the environment before they become obvious (also know as “early signal analysis”).

  • Due diligence

    Due diligence OSINT specialists examine the backgrounds of corporate entities and the principals who manage them. Vendor due diligence is getting more popular, now that business is increasingly conducted online only. Due diligence OSINT specialists can be found in the insurance and risk domain, legal domain, journalism, NGOs, and for every-day consumers.

    For due diligence OSINT research, researchers will look for information in online footprints, academic records, civil filings, media history, liens and judgments, board appointments, corporate records, property records, financial records, subsidiaries, franchises, and social media networks. Depending on the case, researchers can tap into other sources as well, to find links to physical assets and political, corporate or criminal connections.

  • Intellectual property investigations

    In IP investigations, researchers identify threats to IP and confidential information externally, and throughout the supply chain. Analysis of suspect websites, traces in the dark web, combined with social network analysis and sample acquisition can indicate possible IP infringements. When infringements are found, researchers can use OSINT techniques to establish the identity of those involved, and the cost of harm inflicted. This information can then be used in order to assess the damage and prepare legal action.

  • Reputation research and management

    Reputation research and management are getting more important for companies: smearing a reputation has become quite easy due to the amount of review sites and social media platforms.

    For example: sometimes negative articles are published by competitors, and it is difficult to get them removed. Sometimes it is almost impossible to find out who owns the website that the negative articles have been written on, and other times, the owner of the site is willing

    In another case: a politician is getting threats, and wants his address removed from several online registries. A good reputation management OSINT specialist can help in these kind of cases.

  • Detection of data leaks

    Although better used as a monitoring service, in certain cases OSINT specialists are brought in together with forensic investigators, to find out to verify there as been a data leak, and to find out if the data is offered for sale anywhere. Some specialists have experience in finding and recovering stolen data, while others are able to establish what data has been leaked, and how much.

OSINT for recruitment

OSINT is getting pretty popular in recruitment circles: although there is still place for the traditional recruiters, OSINT researchers are starting to specialize in locating and vetting the right person for the right position. The right person can be very modest, so only looking at their LinkedIn profile is not enough.

Some people are also overstating their abilities or experience, so some verification is in order. OSINT researchers can weed out the phonies and fakers, and reveal those diamonds that are too modest to toot their own horn. OSINT recruitment researchers will not just find the right candidate, they will often be able to give you a list to choose from.

They do this by using online communities, social media, and information brokers. Using OSINT, they are able to find hidden nuggets like e-mail addresses and phone numbers of potential candidates.

For example, where a recruiter will be limited by sites like LinkedIn in their search for IT personnel, an OSINT specialist will use sites like Twitter, GitHub, trade shows, or services like IntelligenceX to get the details they want.


The Cyber OSINT area is filled with researchers that are extremely capable in the digital domain. They will find clues in the smallest details of a web page, or can map out an enormous digital infrastructure. Researchers are able to analyze malware, trace emails and connections, or find out who is behind that server that is selling pirated versions of your product.

Cyber OSINT researchers often specialize in areas like Threat Intelligence, digital forensics, e-discovery, or cyber recon. Cyber recon specialists are often used by penetration testers, to map out the digital landscape they’re about to engage.

Dark Web intelligence

With dark web intelligence, intelligence is collected outside the standard internet: Dark web services like the TOR network can only be accessed with special software. Dark web offers a great deal of anonymity, which makes it popular not only with activists, but also with criminals. Pirated goods, hacked credentials, stolen data, drugs and hacking services are all for sale on the dark web. Navigating the dark web is the specialty of dark web researchers: they know how to access it, where to look, and are often able to track criminals despite the anonymity the dark web provides.

Financial OSINT

When researching an organization, there is often a financial part that needs to be handled. Knowing where to look, how to interpret the numbers and calculate reputation is the area of the financial OSINT expert. Financial OSINT is often performed in risk assessments in the financial world, in areas like Due Diligence, AML (anti money laundering) and KYC (know your customer).

An emerging field in the Financial OSINT area is cryptocurrency research, where people specialize in blockchain technologies like Bitcoin. These specialists spend their time investigating digital assets, tracing movement of funds, and attributing digital transactions to organizations and legal entities.


Scammers, phishers, con artists: the world is filled with confidence tricksters that defraud others. Whether they are dealing with corruption, an investment scam, or financial fraud: Fraud OSINT specialists are experts in sniffing out fraud and tracking fraudsters. They know the techniques and the players, and are often used to find out where stolen funds has been sent to.

Big Data research

Big data researchers can provide insight in large sets of data. An example would be: searching thousands of websites for product information, and enriching the results. Or maybe you have a large set of log files, and you need context to make sense of all that data. Big data analysts can take large sets of data, and provide context, visualize results, and predict trends if needed.

Geospatial intelligence

Geospatial intelligence (GEOINT) refers to intelligence about human activity on earth that is collected through all means possible. Part of Geospatial intelligence is image intelligence (IMINT), which is the exploitation and analysis of imagery from satellites, aircraft and drones. GEOINT can use this as well, but also uses GIS information (geospatial information and services) and other information derived from sources other than images.

OSINT researchers who specialize in IMINT, are skilled in collecting, analyzing and interpreting satellite images.There are numerous applications of satellite imagery: OSINT specialists can use information derived from the satellite imagery for corporate decision making, environmental investigations, law enforcement assistance, or location investigations in general.

A good OSINT IMINT specialist can not only give you a clear, concise, and accurate representation of how events are unfolding.They can also show you what happened weeks, months or years ago, and can often offer insight about what might happen in the near future.

For an interesting OSINT case in the GEOINT area, where the number of cars in the Walmart parking lot were used to to show the stock was undervalued, check out Stock Picks From Space (the Atlantic).

Geolocation research

OSINT researchers who specialize in Geolocation research, are skilled in finding out where are photo or video was taken. By looking at details like kind of vegetation, street signs, or building features, Geolocation specialist can often find the exact spot a photo was taken. Originally only used for military purposes, Geolocation is now used in many investigations, from child abuse to fraud and corporate investigations.

Chronolocation research

Just like Geolocation specialist can deduct a location from the details of a picture or video, Chronolocation specialists can deduct the date and time a picture or video was taken. By looking at things like shadow length, weather, vegetation, and other clues, a Chronolocation specialist can often deduct the exact date and time a picture or video was taken. This can be very useful in insurance cases, where pictures of “stolen” equipment are taken after the theft was reported.

OSINT for investigative journalism

OSINT has been made quite popular with investigative journalist, not in the least because of Bellingcat, an investigative journalism website that specializes in fact-checking and OSINT. The site has published the findings of both professional and citizen journalist investigations into war zones, human rights abuses, and the criminal underworld. Bellingcat has shown that you do not need to be a government organization to investigate war crimes or environmental issues.

Some journalists specialize in areas like:

  • Fact finding

    Here, researcher perform hoax detection, track and trace rumors, and verify or debunk fake news.

  • Misinformation research

    Researchers delve into false or out-of-context information that is presented as fact regardless of an intent to deceive. Example of misinformation: “I’ve heard 5G causes cancer!”

  • Disinformation research

    In this area, research look for misinformation that is intentionally false and intended to deceive or mislead. Example of disinformation: “The queen of England is a Satan worshiper!

In all these areas, researchers try not only to detect false information, but they also try to determine how much it has spread, when it was published first, and also who published it (attribution).