Glossary
OSINT
OSINT — open-source intelligence — is information gathered from public sources only: public records, news, social media posts, company filings, maps and photographs.
What it means
OSINT — open-source intelligence — is information gathered from public sources only: public records, news, social media posts, company filings, maps and photographs. It is not hacking: it never involves bypassing logins, passwords or access controls. OSINT is one of the most accessible skills in cybersecurity, and one of the most useful for judging news critically in everyday life, because its core discipline — verify every claim with a second, independent source — applies to everything you read.
How it works
OSINT follows an intelligence cycle: set a question, collect from public sources, process what you found, analyse it, and report it with sources. The two-source rule is its central discipline: a claim is not verified until a second, independent source confirms it from its own evidence — two copies of the same original are one source, not two. The four Ds of media verification guard the source itself: distortion, disinformation, decontextualisation and deepfakes. The legal boundary is sharp: only public information, only lawful collection, and never personal data about a private individual. The OSINT verification exercise on this site gives you a synthetic case file to practise on: verify four claims, flag the ones that fail, and see which sources actually corroborate each other.
Example
Imagine a fictional researcher verifying a viral claim that a company has closed a factory. The post that started it has thousands of shares but no source. She checks the company's own filings — nothing. She checks the local newspaper — a report, but it cites the same viral post. She checks the local council's planning register — an application to convert the site, from an independent public record. Two of her three sources trace back to the same post, so they are one source, not two; the council record is genuinely independent and confirms the closure indirectly. That is OSINT in miniature: not collecting a lot of information, but testing whether two pieces of information genuinely agree.
Common misunderstandings
The most common misunderstanding is that OSINT is hacking by another name. It is the opposite: its defining rule is that it uses public information only and never bypasses access controls. Anyone who describes bypassing a login as OSINT is describing unauthorised access. The second misunderstanding is that more sources means better verification. It does not: ten copies of one claim are still one source, and the two-source rule counts independence, not volume.
Related terms
Learn more
- Learn OSINT from scratch
- MITRE ATT&CK explained
- Security research for beginners
- Threat Intelligence Introduction
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
Is OSINT hacking?
No. OSINT uses public information only and never involves bypassing logins, passwords or access controls. Anyone who describes bypassing a login as OSINT is describing unauthorised access, not intelligence gathering.
What is the two-source rule?
A claim is not verified until a second, independent source confirms it from its own evidence. Two copies of the same original are one source, not two — the rule counts independence, not volume.
Can I use OSINT to research a person?
For a public figure or a company, using public sources is the ordinary work of OSINT. For a private individual, the ethical and legal boundary is much stricter: only public information, only lawful collection, and never personal data gathered to harass, stalk or expose someone.