OSINT (Open-Source Intelligence) is the practice of assembling a picture of an organization purely from information that is already public — no probing, no login attempts, no packets sent to the target itself. This is exactly what makes it invisible to the target's own monitoring, and exactly why security teams must run the same exercise against themselves.
exposure = Σ fragments(source_i)
attack_surface = merge(subdomains, staff, tech_stack, hostnames)
detectability_by_target ≈ 0 // no request ever reaches them
- DNS & subdomains — public DNS records and passive resolvers enumerate every hostname under a domain; a stray
test-old.example.com or staging.example.com often runs unpatched software nobody remembers.
- Document metadata — PDFs, Word and Excel files published on a site embed author names, internal usernames, and the software version that produced them, all readable without opening a connection to anything but the file itself.
- Social media profiles — LinkedIn job listings and employee profiles reveal org charts, team sizes, and the exact frameworks/cloud vendors a company hires for, which narrows down its technology stack.
- Certificate Transparency logs — every publicly trusted TLS certificate is logged to append-only CT logs by design; searching them surfaces internal-sounding subdomains the moment a certificate is issued for them.
Defensive takeaway: none of these techniques touch the target directly — that is precisely why organizations should periodically run this same OSINT process against themselves. Knowing what DNS, documents, employee profiles and CT logs reveal about you is the only way to close those gaps before someone else finds them.