OSINT (Open-Source Intelligence)

OSINT — open-source intelligence — is information collected from publicly available sources: websites, social media, press releases, corporate filings, conference recordings, job postings, code repositories, and leaked databases. The term comes from the intelligence community, but in a security context OSINT is the reconnaissance phase of nearly every targeted social engineering attack. Before the first email is sent or the first call is made, the attacker already knows who reports to whom, who is traveling, which vendor just won a contract, and what the CEO sounds like.

How it works

Attackers assemble a target picture from fragments that are individually harmless. LinkedIn provides the org chart, job titles, and new joiners — ideal spear phishing targets who don't yet know internal norms. Press releases and earnings calls reveal deals, deadlines, and executive voices; conference videos and podcasts supply clean audio for deepfake voice cloning, a technique we break down in our guide to deepfake voice attacks on finance teams. Job postings expose the internal technology stack. Social media supplies personal details — hobbies, family names, travel plans — that make a pretexting call feel authentically personal. Automated tooling can compile much of this in minutes.

The result is precision: a lure referencing a real project, sent while the real approver is verifiably on stage at a conference, is categorically harder to spot than generic spam.

How to defend against it

• Audit your organization's footprint. Periodically review what an outsider can assemble about your executives, finance team, and infrastructure from public sources — and treat that view as the attacker's starting point.
• Minimize needless exposure. Trim role details in auto-reply messages, avoid publishing direct lines and internal email conventions, and coach high-risk roles on social media hygiene.
• Assume the pretext will be good. Verification procedures — callbacks on known numbers, dual approval for payments — must hold even when the caller knows convincing details.
• Train against researched attacks. Simulations built on the same public information attackers would use show employees how convincing a targeted lure really is.