Home / Methodology
Our own OSINT reconnaissance methodology
Eight stages, the same for every matter. Below we show the objective of each stage, the area examined and what the client receives. The full list of techniques and sources is an annex to the contract.
The principle
Reconnaissance run as before an attack — in your defence
The methodology retraces the path someone preparing an attack, a fraud or a lawsuit would take. But we run it on your instruction and in your interest: so that you see your organisation, counterparty or opponent as the other side sees them — before they use it.
The order of the stages is not accidental. Each builds on the findings of the previous one, and the whole closes with the correlation stage, in which individual facts come together into a picture of risk and a concrete action plan.
The process
Eight stages of reconnaissance
For each stage we give the objective, the area examined and the result for the client. We deliberately do not publish tool names or specific queries — the full technical toolkit is provided as an annex to the contract.
-
STAGE01
Preparation, scope and rules of engagement
Before we check anything, we establish why we are doing it and within what limits. We define the objective, scope, legal framework and reporting — and the rules that protect both you and the subject of the reconnaissance from unnecessary exposure.
What we examine
- the objective and the decision it must support
- legal boundaries and the range of permitted sources
- how to run reconnaissance without revealing the engagement
- report format and deadline
What you receive
- a signed engagement letter and non-disclosure agreement
- a clearly written scope — what will and will not be checked
- agreed criteria for what counts as a material finding
-
STAGE02
Reconnaissance of the entity and its environment
We build a baseline picture of the organisation: how it is structured, who controls it and whom it depends on. This is the foundation for every later finding.
What we examine
- ownership structure and ultimate beneficial owners
- capital and personal links to other entities
- key suppliers and dependencies
- history and changes over time
What you receive
- a diagram of the entity's structure and connections
- a list of related entities and people for further analysis
- an indication of higher-risk areas
-
STAGE03
Profiling of staff, identities and contacts
We establish who makes up the organisation and how it can be reached — and impersonated. This stage shows how much about people and internal structure can be established from outside, which is crucial both in due diligence and in assessing susceptibility to phishing.
What we examine
- decision-makers and holders of positions of trust
- corporate address and contact-channel patterns
- public traces of activity and statements
- presence of data in known breaches
What you receive
- profiles of people relevant to the matter, separating fact from hypothesis
- an assessment of how much of the internal structure is visible externally
- an indication of the most exposed people and accounts
-
STAGE04
Domain surface, mail and cloud
We check how the organisation is visible online at the infrastructure level: what domains it holds, how its mail is configured and what it unwittingly exposes in cloud services. This is the most common source of quiet leaks.
What we examine
- primary and secondary domains and their history
- mail configuration and resistance to impersonation
- publicly accessible cloud resources
- certificates revealing system names
What you receive
- a map of the visible domain and mail surface
- a list of unintentionally exposed resources
- specific, prioritised remediation recommendations
-
STAGE05
Services, technologies and industrial systems
We establish what systems the organisation exposes externally and what technologies it uses — with particular attention to control and automation systems (OT/ICS), which in critical infrastructure are sometimes reachable more widely than they should be.
What we examine
- publicly reachable services and login panels
- technologies in use and their versions
- industrial control and building-automation systems
- access points that should not be visible from the internet
What you receive
- an inventory of externally visible services and technologies
- flagging of systems needing urgent attention
- a risk assessment for continuity of operations
-
STAGE06
Leaks, secrets, code and supply chain
We look for information that has leaked from the organisation or its environment: breach data, accidentally published keys and passwords, sensitive fragments of code, and weak links among suppliers and partners.
What we examine
- presence of the organisation's data in breaches and dumps
- accidentally exposed secrets and credentials
- sensitive information in public repositories
- exposure on the side of suppliers and subcontractors
What you receive
- a list of confirmed leaks with an impact assessment
- an indication of secrets to revoke immediately
- an assessment of the risk carried by the supply chain
-
STAGE07
Documents, metadata and public procurement
We analyse documents the organisation has itself published — and what the metadata hidden in them reveals. For public bodies, procurement notices and tender documentation are a rich source.
What we examine
- public documents and their hidden metadata
- technical information revealed in procurement descriptions
- names, systems and infrastructure details in attachments
- patterns revealed across successive procedures
What you receive
- a summary of information leaking through documents
- an indication of what to strip before publication
- recommendations for the document-preparation process
-
STAGE08
Correlation, threat assessment and recommendations
We combine the findings from every stage into one coherent picture. We assess who could use the collected information and how, prioritise the risks and translate them into a concrete action plan.
What we examine
- correlation of findings across stages
- likely scenarios for use of the information
- priorities by importance and ease of abuse
- mapping to recognised threat types
What you receive
- a final report with a summary for the decision-maker
- a prioritised list of risks and recommendations
- an action plan (runbook) for closing the gaps
Why we do not publish the tools. A detailed list of techniques, sources and queries is at the same time a ready-made instruction for anyone who would use it against an organisation. So on the site we present the methodology at the level of objective and result, and the full toolkit — including specific tools and procedures — is handed to the client as an annex to the contract, covered by confidentiality.
Apply this methodology to your matter
The same methodology serves counterparty due diligence, exposure analysis, personal due diligence and audit support. Tell us what you need it for.