# What Is OSINT? What Can an Attacker Learn About Your Organisation? **URL:** https://securesys.com.tr/en/learning/red-teaming-threat-intelligence/what-is-osint-what-attackers-can-learn-about-you ![What Is OSINT? What Can an Attacker Learn About Your Organisation?](/images/bilgi-merkezi/covers/cover-redteam-04.webp) A cyber attack does not always begin with an exploit. For many attackers the first step is not touching a system, but **understanding the organisation**. What assets does the company have on the internet? Which technologies are in use? What is the employee email format? Which managers hold which roles? Which suppliers does the organisation work with? Which services are exposed to the internet? Are there user credentials leaked in the past? Could sensitive information about the organisation have been left in a GitHub repository? Most of these questions can be answered before the attacker has sent a single packet to any system. This process is called **OSINT – Open Source Intelligence**. In cyber security and Red Team operations, OSINT is the process of collecting meaningful information about an organisation, its employees, infrastructure, technology and digital assets from publicly available or accessible sources on the internet. The dangerous side of OSINT is usually not that one single piece of information is critical. The real risk is that hundreds of small pieces come together to form a usable **attack surface** for the attacker. A job posting can reveal the technology in use. A LinkedIn profile can reveal the system administrator. An old subdomain can reveal a forgotten internet-facing service. A data leak can reveal an old user password. A GitHub commit can reveal a corporate email address. Assessed one by one these look insignificant, but combined they can become extremely valuable to an attacker. OSINT is therefore not merely an intelligence gathering method. From a corporate cyber security perspective it is also an important **external attack surface management** topic. #### What Is OSINT? OSINT is the process of collecting, verifying, correlating and interpreting information from publicly available sources. In a cyber security context, OSINT work usually focuses on the following areas: - domains and subdomains, - IP addresses and internet assets, - employee information, - corporate email formats, - social media accounts, - job postings, - technology infrastructure, - GitHub and other code platforms, - DNS records, - SSL/TLS certificate information, - historical data leaks, - third-party suppliers, - cloud assets, - internet-facing applications, - metadata and documents. But the aim of professional OSINT work is not simply to collect as much data as possible. The aim is to answer this question: #### How could this information be used by a real threat actor? This is why OSINT is one of the fundamental parts of pre-attack reconnaissance in Red Team operations. ### Are OSINT and Reconnaissance the Same Thing? OSINT and **reconnaissance** are closely related concepts, but they are not identical. Reconnaissance is the general attack phase in which the attacker gathers information about the target. OSINT is one of the important methods used during that reconnaissance. For example, if an attacker; runs Google searches, examines LinkedIn profiles, researches DNS records, analyses GitHub repositories, checks public data leaks, they may be using OSINT techniques. Within the MITRE ATT&CK framework, pre-attack preparation and discovery activities are also assessed under the **Reconnaissance** tactic. This phase is the invisible but highly significant part of an attack. Because this is where the attacker gets to know the target. ### How Does an Attacker See Your Company from the Internet? Organisations mostly look at their own infrastructure from the inside. IT teams know; the servers, the firewalls, the switches, the endpoints, Active Directory, the applications. All of it is familiar territory. But the world the attacker sees is different. The attacker does not see the company's organisation chart; they see its **digital traces on the internet**. When an attacker researches the company name, for example, they may see; the main website, old web applications, various subdomains, career pages, employee profiles, social media accounts, technical blogs, PDF documents, partner pages, supplier announcements, old conference presentations. When these come together, a fairly detailed profile of the organisation can be built. ### \1. Domains and Subdomains One of the most fundamental areas of OSINT work is **domain reconnaissance**. An organisation may have more than just its main website. For example: www.company.com may be the main website. But the organisation may have dozens or hundreds of subdomains on the internet, such as; vpn.company.com mail.company.com portal.company.com dev.company.com test.company.com api.company.com remote.company.com jira.company.com and many more besides. The real risk usually appears not on the main website, but in a system created years ago and then forgotten. An old test server may still be exposed to the internet. A development system may be accidentally reachable from the outside world. An old VPN system may be running out-of-date software. A subdomain may no longer be in use while its DNS record is still active. For this reason **subdomain enumeration** is one of the important parts of Red Team and external attack surface work. ### \2. What Do DNS Records Reveal? DNS is not merely a mechanism for pointing a domain name at an IP address. From the attacker's perspective, DNS records can reveal important information about the organisation's infrastructure. For example; MX records can show which provider manages the email infrastructure. TXT records can show SPF, DKIM or various service verifications. CNAME records can expose the third-party platforms in use. NS records can show the DNS provider. None of this is a vulnerability in itself. But it can help the attacker understand the organisation's technology landscape. An attacker who knows the email infrastructure sits on Microsoft 365, for instance, can shape their social engineering scenario accordingly. ### \3. SSL/TLS Certificates and Certificate Transparency SSL/TLS certificates published on the internet can also be valuable for OSINT. **Certificate transparency** records can reveal some subdomains an organisation used in the past or still uses. An attacker may come across names that cannot be found directly through DNS, such as; oldvpn.company.com internal-api.company.com testcrm.company.com and similar forgotten hosts. This can be particularly helpful in discovering old or abandoned internet assets. It is therefore important that organisations regularly review not only their active systems but also the internet assets published in the past. ### \4. Why Is LinkedIn Valuable to an Attacker? LinkedIn is an extremely valuable platform for corporate networking. But it is at the same time a rich OSINT source when it comes to employee and organisational information. Through LinkedIn an attacker can learn; employee names, their roles, their departments, their managers, former employees, newly joined staff, technical specialisations, the technologies in use. All of it in one place. An employee's profile might, for example, contain the following: #### Senior System Administrator #### Microsoft 365 #### Azure #### VMware #### Fortinet #### Active Directory This information is highly valuable to an attacker. Because the attacker now knows not just the company, but the specific technical roles within it. ### Why Do Job Postings Matter for Cyber Security? The job postings an organisation publishes can unwittingly describe its technology infrastructure to the outside world. A posting might contain phrases such as; “Fortinet firewall management” “Microsoft Active Directory” “VMware vSphere” “Microsoft 365” “Azure” “PostgreSQL” “Cisco network” “CrowdStrike EDR” and other product names. From an HR perspective these are position requirements. From the attacker's perspective they are a **technology stack**. The attacker now has strong assumptions about which products may exist in the organisation. This does not mean the attack will succeed outright. But it narrows the attacker's research space considerably. ### \5. How Is the Corporate Email Format Discovered? Knowing employee names is important for an attacker. But turning those names into corporate email addresses is more valuable still. A company might use one of the following email formats, for instance: first.last@company.com firstname.surname@company.com fsurname@company.com firstname@company.com Once one or two valid corporate email addresses are identified, the general format can be inferred. Employee names obtained from platforms such as LinkedIn can then be used to construct potential email addresses. This process can be called **email enumeration**. The attacker can thereby build specific target groups such as; finance managers, human resources staff, IT personnel, senior executives, procurement teams. Each group can be approached differently. This information makes social engineering and phishing attacks far more targeted. ### \6. Why Does OSINT Strengthen Spear Phishing? Generic phishing attacks may send the same message to thousands of people. **Spear phishing**, by contrast, is a targeted attack aimed at a specific person or employee group. OSINT allows these attacks to be prepared far more convincingly. An attacker may, for instance, have learned the following through LinkedIn: An employee has just started a new role. They are working on a Microsoft 365 migration project. They report to a particular manager. The company recently signed an agreement with a new supplier. Using this information the attacker can craft an extremely realistic email. The message then bears no resemblance to a classic spam email. It appears related to the user's day-to-day working life. OSINT and social engineering should therefore not be thought of separately. **OSINT is what allows the attacker to build context.** ### \7. GitHub and Open Source Code Repositories Developers and technology teams may be active on GitHub, GitLab or similar platforms. Used carelessly, these platforms can cause significant data leaks. A repository may accidentally still contain; an API key, an access token, a database connection string, a cloud credential, an internal hostname, an IP address, a corporate email address, test user details. Any of these can be left behind. Modern code security processes use secret scanning tools to try to detect such information. But sensitive data may remain undeleted in past commits. Even if a secret has been removed from the current code, it may still live on in the Git history. For this reason OSINT work may need to consider not just active repository files, but past commits too. ### \8. How Much Can Document Metadata Reveal? PDF, Word, Excel or PowerPoint files that companies publish on the internet can sometimes carry metadata. Metadata may contain information such as; the user who created the document, the computer name, the software version, the file path, organisation details, the creation date. All of it embedded invisibly in the file. A username inside an old published PDF, for instance, can give a clue about the organisation's user naming convention. Information of this kind does not amount to an attack on its own. But combined with other OSINT data it can become far more meaningful. ### \9. Data Leaks and Credential Exposure One of the most critical areas of OSINT work is the assessment of past data leaks. Even if an organisation has not been attacked directly, another platform used by one of its employees may have suffered a data leak. The employee may, for instance, have registered on a different service using their corporate email address. When that service is breached, details such as; the email address, the username, the password hash, the telephone number can be exposed. This creates **credential exposure**. The risk grows further where password reuse is involved. Organisations must therefore track not only the security of their own systems, but also the exposure of user accounts across the internet. ### \10. Is the Dark Web Part of OSINT? The dark web and closed forums may not be considered fully open source in the classic sense. But in cyber threat intelligence work, information such as; stolen credentials, data leaks, accesses put up for sale, organisation names, ransomware group posts can be tracked from these platforms. Here OSINT and **cyber threat intelligence (CTI)** converge. OSINT focuses mainly on collecting publicly available information, while CTI analyses that information in a threat context and turns it into actionable intelligence. For example; **“An employee email address was found in a data leak.”** is a data point. But; **“This credential may have been put up for sale by an initial access broker targeting the same sector.”** moves into the realm of threat intelligence. ### \11. Shadow IT and Forgotten Systems One of the most significant problems of the corporate attack surface is **shadow IT**: systems used outside central IT management or without adequate control. A department may, for its own needs, have used; a cloud service, a file sharing platform, a test server, a web application, a SaaS product. None of it registered centrally. After a while the project ends. But the system carries on living on the internet. The IT team may forget it exists. The attacker does not. The asset can be rediscovered during internet-wide system scans. External attack surface management is therefore not just about protecting known systems, but about **finding unknown assets**. ### \12. Third-Party Risk: Suppliers Are Part of the Attack Surface Too The digital estate of a modern organisation is not made up of its own systems alone. Many organisations work with; software providers, cloud services, outsourcing companies, accounting systems, human resources platforms, support firms, integrators. Each relationship carries data. These suppliers may hold various pieces of information about the organisation. They can also constitute an indirect attack route for an attacker. **Third-party risk** must therefore also be assessed in Red Team and threat intelligence work. Instead of targeting the large organisation directly, an attacker may target a smaller and weaker supplier. They can then use the trusted business relationship to approach the main target. This approach forms the basis of **supply chain attack** risk. ### How Does OSINT Research Build an Attacker's Profile? Let us now combine the different pieces of information. Suppose an attacker has obtained the following: The company uses Microsoft 365. There is a Fortinet VPN infrastructure. The IT manager's name is known. The names of finance team employees can be found. The corporate email format has been identified. An old subdomain has been discovered. An employee's email address was seen in a past data leak. A commit belonging to the company domain was found on GitHub. Taken individually, none of these may look like a “critical vulnerability”. But from the attacker's perspective the following is now available: #### Target individuals #### Technology infrastructure #### Email structure #### Internet attack surface #### Potential credentials At this point OSINT can begin turning from passive reconnaissance into active attack preparation. ### MITRE ATT&CK and Reconnaissance Within MITRE ATT&CK, the Reconnaissance tactic classifies the behaviours through which an attacker gathers information about a target. At this stage the attacker may try to collect information about; network details, domain details, organisational structure, employees, technology infrastructure, internet assets. All of it before any intrusion. The main reason this approach is used in Red Team operations is to simulate the behaviour of real threat actors more realistically. If an attacker does not know their target, the attack is random. With sufficient knowledge of the target, the attack becomes a **targeted attack**. ### The Relationship Between OSINT and Attack Surface Management It is not enough for organisations to look at OSINT only through the attacker's eyes. The same techniques can be used defensively. This approach is usually considered under **external attack surface management (EASM)** or **attack surface management (ASM)**. The aim is to continuously discover the organisation's digital assets as they appear from the outside world. For example; a newly created subdomain, a service accidentally exposed to the internet, an expired certificate, a shadow IT system, cloud storage, an old application, an exposed management interface can all be detected. The core idea here is this: **You must see your own attack surface before the attacker does.** ### How Can Organisations Reduce OSINT Risk? OSINT is not something that can be prevented entirely. Because companies need to be visible on the internet. Websites will be found. Employees will use LinkedIn. Job postings will be published. Corporate email addresses will be used. What matters is reducing unnecessary information leakage. Organisations should regularly review; their internet asset inventory, domains and subdomains, cloud resources, GitHub and code platforms, leaked credentials, corporate email exposure, legacy applications, documents containing metadata, information leakage originating from social media. All of this belongs in a recurring cycle. Alongside this, OSINT should also be covered in **security awareness** training for employees. Because some of the information employees share online can strengthen attackers' social engineering scenarios. ### What Is an OSINT Assessment? Organisations can carry out an **OSINT assessment** as an independent exercise, not only during an attack. The purpose of this work is to determine what information about the organisation is accessible when viewed from the outside. A professional OSINT assessment may analyse; corporate domains, subdomains, internet assets, employee information, email addresses, the technology stack, leaked credentials, code repositories, document metadata, cloud assets, third-party relationships. All of it in one structured review. At the end of the exercise the output should not be a list of data, but a risk analysis explaining **how the information could be used by an attacker**. ### Why Is OSINT Critical in Red Teaming? OSINT provides three important benefits in Red Team operations. First, it increases the realism of the attack scenario. Rather than attacking the system directly, the Red Team researches the target like a real threat actor. Second, it exposes unknown attack surfaces. Systems that are absent from the organisation's IT inventory yet reachable on the internet can be identified. Third, it improves the quality of social engineering scenarios. An attacker who understands employees and business processes can prepare far more convincing attacks. OSINT is therefore not merely the preparation phase of advanced Red Team operations; it is an important **threat modelling** input. ### The Difference Between OSINT and Cyber Threat Intelligence OSINT and cyber threat intelligence are frequently confused. A simple distinction can be drawn: **OSINT collects information.** **Threat intelligence places that information in a threat context.** Finding a company's VPN address on the internet may be OSINT. Analysing that this VPN technology is being actively targeted by a particular threat group, and identifying the associated attack techniques and indicators, falls within threat intelligence. The strongest security approach uses both fields together. OSINT shows how the organisation looks from the outside. Threat intelligence helps you understand **by whom and how those visible assets could be targeted**. ### Is Searching Your Company Name on Google Enough? No. Classic search engines are only a small part of OSINT. A professional attacker or Red Team specialist assesses different sources together. DNS data, certificate records, internet scanning services, code platforms, social media, cloud resources, archived web pages, data breach records, domain histories are analysed side by side. The power of OSINT comes not from a single source but from **correlation**. Matching one piece of information with another can create a completely new meaning for the attacker. ### What Should an OSINT Report Contain? A corporate OSINT or Red Team reconnaissance report should not consist merely of a list of what was found. It is useful for the report to assess at least the following headings: #### Executive Summary The most important digital exposures from a management perspective. #### External Attack Surface Assets reachable on the internet. #### Domain & Subdomain Findings Domain and subdomain visibility. #### Technology Exposure Technology infrastructure detectable from the outside. #### Employee Exposure Visibility of employee and email information. #### Credential Exposure Leaked or exposed account details. #### Code & Secret Exposure Possible sensitive information in public code repositories. #### Third-Party Exposure Digital exposure originating from suppliers. #### Risk Scenarios How this information could be turned into an attack chain by an attacker. That last section matters most of all. Because to understand the risk of a piece of information you need to see not just **“what was found”**, but **“what it could turn into”**. ### Conclusion: The Attacker Looks at Your Organisation Differently from You A company's security team may believe it knows its own systems. But the attacker is looking somewhere else. The attacker does not start with the organisation chart. They do not know the firewall configuration. They do not have the internal network diagram. Instead they collect the small pieces visible from the outside. A LinkedIn profile. A job posting. A DNS record. An old subdomain. A GitHub commit. A leaked email address. A PDF metadata entry. Individually this information may look insignificant. But correlated correctly, a digital map of the organisation begins to form in front of the attacker. And that is where the importance of OSINT for Red Teaming and cyber threat intelligence becomes clear. **You cannot fully manage your attack surface without knowing what the attacker knows.** In the modern cyber security approach the question should therefore not be only; **“Which of our systems are exposed to the internet?”** The broader question is this: **“What could an external threat actor learn about our organisation, our employees and our technologies, and what attack route could they turn that information into?”** The answer to that question directly affects initial access risk. Because once the attacker knows the target well enough, they move from gathering information to the first real step of the attack.