More is out there than you think
Old domains, former company names, related businesses, staff profiles: over the years a lot of information becomes public that nobody keeps track of.
An attacker does not look at these one by one – they connect them.
OSINT
Public information can expose more than expected.
We map what an attacker could learn about your organisation, your people and your systems from public sources alone – and show you what is worth restricting.
Exposure
Your organisation may already be exposed.
Publicly available information can reveal how your organisation operates, who your key people are and what technologies you rely on. This information is often fragmented, but when combined, it provides attackers with a clear picture.
A name and an email address are enough for a targeted attack
A professional networking profile, a company email address and a press article are enough to build a convincing, personalised phishing message.
An attacker can even pose as your CEO or a well-known partner.
Reconnaissance without alerts
Passive data collection usually goes unnoticed.
External reconnaissance does not necessarily trigger alerts or log entries in your internal systems.
The results show which public information an attacker could build a targeted attack on, and what is worth removing or restricting. An OSINT assessment is also a good starting point for a phishing simulation or a red team engagement.
Request a consultationMethodology
How we assess your public exposure.
Our OSINT assessments follow a structured approach focused on how publicly available information can be collected, correlated and used in real-world attack scenarios. We combine automated data collection with manual analysis to identify meaningful connections and potential risks.
The objective is to identify additional domains, email addresses and publicly available information connected to your organisation.
- Employees of the identified domains
- Related companies or entities
- Previously used company names
This helps reveal how publicly available information can extend beyond the expected scope.
- Identified email addresses linked to individuals
- Connections to related domains
- Historical or cross-organisational references
This includes open databases, search engines and OSINT-specific tools to gather information without direct interaction with the target systems.
- Google dorking techniques
- Passive automated tools
- OSINT investigation platforms
Both free and commercial tools may be used, depending on the assessment context.
- Possible attack scenarios based on the findings
- Recommendations for removing or restricting public information
Our reporting system is easily accessible to the technical team and decision-makers alike.
Insights
OSINT insights and real-world cases.
Insights and real-world examples showing how publicly available information can be used to map organisations, identify individuals and prepare targeted attacks.
DNS security
Hidden Security Risks of CNAME Records | Dangling DNS
Dangling CNAME records: Hidden DNS security risks for businesses One of the lesser-known yet increasingly relevant security risks in modern web infrastructure is dangling CNAME records. At first glance, these abandoned …
Read more
Social engineering
Phishing and Social Engineering: How Attackers Compromise Your Company with a Single Click
Phishing: The attacker is not hacking your systems – they are hacking your employees Fact: even the most expensive security stack can be bypassed with a well-written email. We wish we could say that it is a poetic …
Read more
Consultation
Security starts with a conversation.
No sales pitch – just a focused conversation about your business continuity and operational risk.