Empower your OSINT: tools, techniques, and investigative strategies for better open-source intelligence

Empower Your OSINT: tools, techniques and investigative strategies for better open-source intelligence. 

OSINT tools can uncover an extraordinary amount of information. But better open-source intelligence doesn’t always come from having more tools. It comes from knowing what you’re looking for, where to look next and when a piece of information is worth pursuing.

That was the central theme of Altia’s latest Empower Your OSINT webinar, where Toby Langston and Dave Sampson sat down with OSINT practitioner and private investigator Ionatan Waisgluss to talk through how investigators can sharpen their technique and get more out of the information available online.

Here’s what stood out.

Start with the question, not the search bar

The easiest trap many fall into when using OSINT is collecting too much data. Give an investigator access to powerful OSINT software and dozens of data sources, and the natural instinct is to search everything, which as Toby put it, tends to produce a “soup of nothingness”. This ultimately leaves you with huge volumes of information without enough relevance or direction.

Ionatan’s approach was to refer back to the intelligence cycle, define the requirement, and collect only what’s relevant. From there, you can assess what’s been found, report what matters, and use the findings to make future decisions or actions.

As Dave highlighted, it’s also important to remember that just because an investigator can collect something doesn’t automatically mean they should. Purpose, necessity, proportionality, permissions and the relevant legal framework all matter.

Follow the pivot

Investigations rarely move in a straight line. A phone number reveals a username; the username identifies an account; the account reveals another identifier, and so on.

Ionatan calls this the OSINT pivot, which ultimately means taking something useful and turning it into your next starting point. The key word here is useful. The goal isn’t to branch into every single data point, but to follow the threads that are relevant and can actually move you toward answering the original question.

Hoard your tools. Just organize them

During the webinar, Ionatan admitted he’s a hoarder when it comes to OSINT tools. He noted how he’s moved away from the chaos of spreadsheets and browser bookmarks toward tools such as Obsidian where connected notes can be used to organize tools, techniques and approaches.

A good approach is to organize resources around how an investigation begins. What do you search for first? A phone number? An email? A domain? The aim is to build a system that helps you quickly move from identifier to the appropriate technique and relevant sources.

When asked about identifiers, Ionatan said his go-to was OSINT Industries. Now integrated into Altia’s OSINT solution, the tools allows investigators to bring these searches into a wider investigative workflow. UserSearch was also mentioned with the caveat that he hasn’t fully tested its recent version.

Don’t sleep on Google

Specialist OSINT software is valuable, but sometimes one of the best investigative tools is already sitting in your browser. Search engines become considerably more useful when investigators move beyond ordinary keyword searches.

Using advanced search operators (Google dorking) can make searches much more targeted:

• Quotation marks can search for exact phrases
• The site: operator can restrict a search to a specific website/domain
• The filetype: operator can target particular types of indexed files
• Minus operators can remove unwanted terms and reduce irrelevant results.

These kinds of tips help not only refine your search but also uncover indexed documents that were never meant to be public. Ionatan’s blog, Applied Awareness, particularly the article on Finding Public Files That Probably Shouldn’t Be Public, are worth a bookmark. The article touches on two different perspectives: a security gap for the organization, a potential goldmine for the investigator. As Dave put it, “one person’s exposure is another person’s gold mine of information.”

Look past the page

Another strong example of investigative pivoting came when the conversation moved from websites themselves to the technologies behind them. Ionatan highlighted BuiltWith, a website which profiles the technology behind a website.

For an OSINT investigator, this can create interesting new leads as shared analytics IDs or other technical fingerprints across sites can reveal new connections or links. But, as the webinar stressed, a connection isn’t a conclusion. Two sites sharing a technical identifier might just share a developer or agency. It’s a pivot worth investigating, but not proof of common ownership.

That’s the difference between collecting OSINT and analyzing it.

Your network is part of your toolkit

Your OSINT network is a tool too. Nobody knows every OSINT tool, platform, technique or obscure source of information. That’s why Ionatan encouraged investigators to build relationships across the OSINT and cybersecurity community.

The community contains people with many different specialties, so chances are someone can help if you’re facing an unfamiliar problem. That doesn’t mean sharing confidential details about an investigation. It can simply mean describing the type of problem you’re trying to solve and asking whether anyone knows an appropriate resource.

The dark web is an OPSEC problem, not an access problem

Operational security (OPSEC) is the process of identifying what your activities could reveal and taking appropriate measures to reduce that exposure. OPSEC is particularly important when it comes to the dark web, where accessing information often isn’t the problem. The challenge is investigating without exposing yourself, your organization, or the case. For an OSINT investigator, that means thinking about the digital traces created by investigative activity and considering associated threats.

Ionatan highlighted how there isn’t one universal OPSEC setup and precautions should reflect the activity and threat model. His broader advice was learning from other people’s mistakes is better than learning from your own. Looking at how investigators, systems or threat actors have previously exposed themselves can help practitioners identify risks before repeating them.

The takeaway

Tools matter, but they’re not the point. The investigators who get the most out of OSINT know their question, follow useful pivots, organize their resources, and treat technical connections as leads rather than proof. They think about ethics, legality and OPSEC before clicking “search”, and most importantly, they keep learning and adding to their toolkit.

Explore the tools linked throughout this article and watch the full webinar here.

The conversation is continuing offline too, as Altia will be attending BSides Ottawa, the community-led cybersecurity conference in Ottawa. If you’re attending, look out for Toby and come and say hello.