Services · OSINT
OSINT investigation: establish what attackers already know about your organisation
Before attacking, an adversary does their research. An OSINT investigation reconstructs, from open sources, what they can learn about you: exposed infrastructure, executives’ data, leaks, traces left by your teams. BEAROPS analysts from the offensive field carry it out on a specific question: an OSINT assessment of your exposure, due diligence before a decision, executive exposure or an inquiry into an incident. You receive documented findings and a practical plan to reduce that exposure before it can be used against you.
- Expert human analysis
- Legal framework respected
- Practical reduction plan
- In French or English
What does an OSINT investigation cover?
| Area | What we look for |
|---|---|
| Organisation | Exposed infrastructure, documents published by mistake, technical traces, brands and domains |
| Executives and key people | Personal data that could be reused for fraud or targeted manipulation |
| Ecosystem | Suppliers, subsidiaries and partners through which an attacker could pivot |
Why does human analysis change everything?
A tool collects; an analyst understands. The value of an OSINT investigation lies in cross-referencing information and turning it into scenarios: on its own this piece of data is harmless, linked to two others it opens the way to a credible attack. Our analysts come from the offensive field and read your traces as an adversary would.
What forms can an OSINT investigation take?
-
Due diligence intelligence
Vet a partner, an executive or a target before a sensitive decision
-
Executive exposure
Reduce the personal risk facing members of your executive committee
-
Incident inquiry
Document a leak, an impersonation or a targeted threat
What do you receive at the end of the investigation?
- A map of your open-source exposure.
- The attack scenarios this exposure makes credible.
- A prioritised reduction plan: what should be removed, corrected or monitored.
- A debrief with the teams concerned.
An OSINT investigation is a one-off, in-depth engagement carried out by our analysts. To track exposure continuously and enrich your threat signals between two engagements, Beareye’s OSINT monitoring takes over.
What legal framework applies to an OSINT investigation?
OSINT only collects information available from open sources, without intrusion or unauthorised access. Each engagement rests on a written mandate that sets its purpose and scope. When it concerns individuals, collection follows the GDPR: it is limited to what the purpose of the mandate requires (data minimisation), remains proportionate to what is at stake and follows a strict ethical framework.
Sources and references
Sources consulted on . Report an error: contact+site@bearops.fr
Frequently asked questions
What is an OSINT investigation?
It is research carried out by analysts in open sources, on a specific question: what an attacker can learn about your organisation (the OSINT assessment), the reliability of a partner, the exposure of your executives or the facts of an incident. It leads to documented findings and a plan to reduce exposure before it is exploited.
Is OSINT legal?
OSINT is limited to publicly available information, without intrusion or unauthorised access. Engagements respect personal data protection. Each engagement rests on a written mandate that sets its purpose and scope.
Who carries out the OSINT investigation?
BEAROPS analysts from the offensive field. They cross-reference the information collected and turn it into scenarios, as an adversary would. The investigation is not a tool-generated report: it is a human engagement, scoped with you, which leads to a prioritised reduction plan and a debrief with your teams.
How long does an OSINT investigation take?
From a few days to several weeks, depending on the scope and the depth required. An engagement focused on executives is not on the same scale as a full map of the organisation and its ecosystem. We agree the scope and timeline together at the outset.
Find out what an attacker knows about you
Book a call with a BEAROPS analyst to scope the investigation: the question to address, the scope, the legal framework and the quote.