One email address on a company website can reveal a naming pattern. Pair first.last with names in public articles or staff profiles, and an attacker has a list of likely accounts to check. A vendor announcement or job posting can then tell them which request might sound familiar to the person behind an account.
Open-source intelligence, or OSINT, is the work of collecting and connecting information that is publicly available. For a business, that includes more than search results. Domains, public IP addresses, exposed services, certificates, code repositories, staff profiles, and documents can all tell an attacker where to look next.
The question is not just, "What is online?" It is, "What could someone use together to reach our systems or fool our people?"
The clues become an attack path
When I examine a public footprint, I look for that chain. A leader's contact details may reveal the email format. Staff profiles supply likely names. Public services can reveal which accounts exist. The same material can support a password spray or a convincing request that appears to come from a colleague or vendor.
Publishing names and contact information may be good for the business. The answer is not to hide every employee. It is to know which path the information creates, protect the accounts behind it, and require a separate check before money or access changes hands.
The technical side matters too. A forgotten subdomain or remote-access portal can expose a service the business no longer watches. A scan can reveal known weaknesses and configuration changes. An analyst then checks which findings matter to the business and how an attacker might use them.
That is the counterintelligence focused view: learn what the adversary can see, understand the move it enables, and prepare the people and systems most likely to meet it.
Turn the outside view into decisions
Praeven's External Exposure Review connects public-source research with checks of internet-facing systems. The kickoff establishes the picture. Monthly reviews look for new weaknesses, changed services, and information that makes impersonation or fraud more convincing. A threat brief adds the attacker activity worth watching now.
The report should answer three questions:
- What can someone reach or learn from outside the business?
- How could those clues support access, impersonation, or fraud?
- Which change would make that path harder?
That may mean patching an exposed service, retiring an old domain record, removing sensitive details from a public document, or adding a separate verification step before payment details change. The point is not to collect more findings. It is to change what an attacker can do with them.
Explore External Exposure ReviewDiscuss your public footprint