Reconnaissance and OSINT

Reconnaissance gathers facts about a target before deeper security testing, while open-source intelligence turns publicly or commercially available information into findings that answer a defined question. Together they map people, domains, systems, and relationships without treating every clue as proof.

itOffensive security and application security

Reconnaissance and OSINT

Reconnaissance is the deliberate collection of information about a target before deeper security testing. Open-source intelligence, or OSINT, is intelligence derived exclusively from publicly or commercially available information to address a defined requirement. In an authorized security assessment, the two overlap: reconnaissance defines what is exposed, and OSINT supplies many of the observations used to build that map.

The work is not a search-engine scavenger hunt. It is an evidence process:

Question and scope → collection → normalization → pivots → verification → preservation → assessment → report

The question controls the process. “What internet-facing systems belong to this organization?” produces different collection choices from “Is this image connected to the claimed event?” Scope defines which entities, time period, sources, and interactions are allowed. A rules-of-engagement document grants authority for specified security-testing activity; finding a public identifier does not expand that authority.

Information becomes intelligence through analysis

An observation is a recorded fact from a source. A lead is an observation worth testing. A hypothesis explains how several observations might relate. A finding is a supported answer to the investigation question, with provenance, confidence, and limits.

This distinction prevents a common failure: copying search results into a report and calling the result intelligence. Search ranking is not verification. A domain in a certificate, an address in a registry, and a name in a code repository each describe different things. The analyst must decide whether they refer to the same entity, whether the record is current, and what conclusion the evidence actually supports.

Reconnaissance and OSINT

Reconnaissance and OSINT

Information becomes intelligence through analysis

The collection surface

Relevant careers