Attackers research your staff before writing a single email. See what OSINT reveals, where it comes from, and how OPSEC reduces what they can use.
OSINT means open-source intelligence, which is data gathered from public sources such as social media, company sites, job ads, and public records. Attackers use it to research your staff before writing a single email. OPSEC is the discipline of limiting what they find. You cannot hide everything, so the goal is to reduce what is useful to an attacker.
People ignore a generic phishing email. They open one that names their manager, their project, and their renewal date. Research makes that difference, and it happens before any attack reaches you.
Most attack models, including MITRE ATT&CK, put research first. Nothing illegal happens here. The attacker simply reads what you already published, so no alarm fires and no tool blocks it.
That quiet stage shapes everything after. Social engineering works when a message fits the target’s world, and OSINT teaches attackers what that world looks like.
OSINT comes from a handful of ordinary sources.
| Source | What it reveals | Why it helps an attacker |
|---|---|---|
| Professional networks | Names, roles, who reports to whom | Builds an org chart for impersonation |
| Job postings | Internal tools and systems you run | Names the software to fake |
| Company website | Email format, leadership, locations | Lets them guess addresses |
| Away-from-desk replies | Who is away and who covers | Creates a window for urgent requests |
| Social media | Travel, events, personal interests | Supplies the convincing detail |
| Breach databases | Old passwords tied to work addresses | Enables password spraying |
| Document metadata | Usernames, software versions | Confirms naming conventions |
The pattern is that none of this is secret. Your own teams publish each item on purpose, usually for recruiting or marketing. Risk appears only when someone combines the pieces.
A worked example shows how fast it compounds. An attacker finds your finance manager on a professional network. A job ad names the accounting system you run. An away-from-desk reply names the stand-in. The attacker then emails that stand-in about an urgent invoice, in the right system, during the manager’s absence. Nobody hacked anything. Your teams published it all.
Discover how Threatcop protects your workforce from modern cyber threats.
You cannot delete your company from the internet, and you should not try. Recruiting, sales, and credibility all need visibility. OPSEC asks a narrower question: which details help an attacker more than they help us?
Work through it in four steps.
Pay attention to document metadata too. Files published on your site often carry the author’s username and the software version used to create them, which confirms naming conventions an attacker would otherwise guess.
Then repeat it. Staff change roles, new job ads go up, and the picture drifts within months. Treat it as a scheduled task rather than a one-off, and give it an owner so it does not quietly lapse after the first pass.
Most OSINT exposure comes from normal behavior, not sloppiness. So the message should not be “share nothing”.
Tell staff three things instead, as part of your wider countermeasures against social engineering. First, a detailed professional profile is fine, but naming internal systems and security tools helps an attacker more than it helps a career. Second, conference talks, badges in photos, and team posts reveal more than people expect. Third, reused passwords matter, because attackers test old breach data against work accounts years later. Threatcop’s free tools such as Email Hack Checker show staff what is already exposed.
The habit that matters most is simple. When a message shows unusual knowledge about you, treat that as a reason for more caution rather than less. That reflex is what targeted-attack training is really building. Specific detail feels like proof the sender is real, and attackers count on that.
Knowing attackers research your staff helps only if you test what that research enables. A generic phishing test will not show you.
Threatcop Security Awareness Training (TSAT) handles that work. It runs spear phishing simulations using a fake CC, which mirrors how real attempts borrow authority from a name the target knows. You can also shape lures around roles rather than send one generic blast, so the test reflects what OSINT makes possible.
Its Employee Vulnerability Score then shows who acts on those targeted lures. That matters, because a team average hides the staff most exposed to research. It also measures average breach time, meaning how long from lure to compromise. That number shows how much room an attacker would have. Repeat-offender flagging shows where coaching should go next. Active Directory links keep those groups current as people change roles.
No tool alerts you while someone runs OSINT on your staff, because nobody breaks in. So the work sits in two places. Reduce what is worth finding, by trimming internal system names from job ads, keeping away-from-desk replies vague, and reviewing what leadership publishes. Then train people for what the research produces, which is a message that already knows their manager’s name and their current project. Teach the reflex that unusual specificity deserves more suspicion, not less. A well-researched attacker still fails against one person who checks through a channel they already trust, which is why fast reporting matters more than spotting every clue.
OSINT is open-source intelligence, meaning data collected from public sources. In security, it describes how attackers research a target using social media, job postings, company sites, and public records before they attack.
No. OSINT uses data that is already public, so collecting it breaks no law in itself. That makes it hard to defend against, because nobody breaches a system and nothing raises an alert during the research stage.
OSINT is the gathering of public data. OPSEC is the practice of limiting what useful data an attacker can gather. One is the attacker’s activity, and the other is your countermeasure.
Attackers use OSINT to map who works where, who reports to whom, and what systems you run. They can then write a message naming real people, real tools, and real timing, which beats a generic lure easily.
No, and trying would damage recruiting and sales. Aim instead to cut the detail that helps an attacker, such as internal system names in job ads. Then train staff to treat unusually specific messages with more caution.
Sushant Kumar is the AVP – Technology at Threatcop, bringing over a decade of experience in technology leadership and product development. He has worked across technology-driven organizations, including Paytm, and focuses on building scalable solutions that address evolving business and cybersecurity challenges. His areas of interest include cybersecurity technology, AI-driven security, product innovation, and enterprise technology. He is passionate about using technology to solve complex security challenges.
Modern phishing kits bypass MFA, hide from scanners, and ask victims to run commands. See what the tools now...
Federal support for state and local cyber defense ended in 2025 while attacks rose. See what changed, and the...
Gateways filter mail before delivery. API-based tools inspect it inside the mailbox. See how they differ, where each fails,...
