OSINT (Open-Source Intelligence) is the practice of gathering and analyzing intelligence from publicly available sources — search engines, social media profiles, WHOIS domain records, public documents, image metadata — without hacking, scraping private data, or any unauthorized access. If it's already public, reading it carefully and connecting the dots is OSINT.
Where OSINT actually looks
Search Operators
Precise search queries — exact phrases, restricting to a site or file type, excluding noisy terms — surface far more than a plain keyword search.
Social Profiles
A display name, handle, bio, and join date can connect an identity across platforms and time-box when activity started.
WHOIS Records
Domain registration data — registrar, creation date, registrant country — helps establish ownership and history.
Even images carry public clues: camera model, timestamps, and visible backgrounds in a published photo can all be read without any special access — which is exactly why OSINT practitioners are taught to think about what a picture reveals before posting one themselves.
What separates OSINT from hacking
The line is access. OSINT only touches what's already open to anyone — a public profile, a public registry, a published document. The moment a technique requires bypassing a login, scraping data behind authentication, or accessing something the owner didn't intend to be public, it's no longer OSINT; it's a different (and often illegal) category of activity entirely.
Who actually uses it
Security researchers use OSINT for reconnaissance before authorized testing. Journalists use it to verify claims. GRC and vendor-risk teams use it as part of third-party due diligence — checking a vendor's public footprint before onboarding. The technique is identical across all of these; only the purpose differs.
Where to actually practice it
The OSINT Mini-Quest and its companion OSINT tutorial walk through exactly this kind of exercise — reading a profile, a WHOIS snippet, and image notes to find specific answers, safely and with static, fictional data.