Table of Contents
Author
James Westlake
James Westlake
Former British Army officer, trained in surveillance and target acquisition, and Bain and Company engagement manager, with more than a decade of experience working in consulting, private equity and venture capital across Western Europe.
The challenge in open-source research is rarely a lack of information. It is knowing which sources matter, which tools fit the question, and which findings can withstand scrutiny.
A company search can produce registry entries, archived websites, court records, social profiles, domain data and hundreds of media mentions. Without a defined process, that volume creates noise rather than intelligence. Analysts may collect too much, mistake repetition for corroboration or lose the source trail behind an important claim.
The term “OSINT Framework” is used for two related but different things. Capitalised, it usually refers to the OSINT Framework, an online directory that organises open-source research tools by category. In a broader sense, an OSINT framework is a repeatable method for turning publicly or commercially available information into an assessment that answers a specific question.
Both are useful. Neither replaces analytical judgement.
Open-source intelligence, or OSINT, is intelligence produced from publicly or commercially available information. “Open source” here refers to the availability of information, not open-source software. A corporate filing, satellite image or social media post is an input. It becomes intelligence only after an analyst tests its relevance, reliability and meaning against a defined requirement.
The US Intelligence Community defines OSINT as intelligence derived exclusively from publicly or commercially available information that addresses specific priorities, requirements or gaps. This definition prevents a common error: treating any online search result as OSINT.
Open sources can include:
Access conditions vary. Some information is free. Some requires registration or a paid subscription. Some is public but still subject to privacy, copyright, database-right or platform restrictions. “Open source” therefore describes how information is available, not a licence to collect or use it without limits.
There are two meanings to keep separate.
The OSINT Framework website is a tree-structured directory of tools and resources organised by research category. It does not conduct an investigation for the user. Instead, it helps a researcher move from a starting identifier or research task to categories of potentially relevant sources.
For example, an analyst may begin with a company domain. The relevant branches may lead to domain records, certificate data, website archives, email formats, public documents or exposed infrastructure. A username inquiry follows a different path through account-discovery and social-platform resources.
The project began with an information-security focus but now covers a wider range of research tasks. Its public GitHub repository allows contributors to suggest additions, flag problems and update resource metadata.
The directory uses markers that describe access requirements:
Newer entries can also carry fields for status, pricing, input, output, operational-security considerations and whether a tool is deprecated. These details help with initial selection, but they do not amount to independent assurance. Tools change ownership, alter their terms, lose data access or stop working.
In professional research, “an OSINT framework” often means the policies and steps used to run a case. It defines the question, legal scope, collection plan, evidence standard, analytical method, review process and reporting format.
This second meaning is more important to the quality of the result. A directory can point to a registry. It cannot decide whether a historical director is relevant, whether two people with the same name are the same person or whether an apparent link would survive legal review.
A sound methodology also makes research repeatable. A second analyst should be able to understand what was searched, when it was searched, which sources were used and why the final assessment reached its stated level of confidence.
The open-source environment contains primary records, copied records, commentary, rumours, manipulated media and machine-generated text. Search engines place them side by side. Their ranking is not a reliability assessment.
Consider a claim that an investor controls a supplier. A copied corporate profile may repeat the claim across ten websites. Those ten pages may all derive from one incorrect record. Proper analysis would trace the claim to corporate filings, shareholder disclosures, historic snapshots, transaction documents and other independent evidence.
This is why source provenance matters. Analysts need to know who created a record, for what purpose, at what time and with what access to the facts. They also need to distinguish a source from a claim. A credible publication can report an unverified allegation; an interested party can publish an authentic document.
The strongest OSINT products separate four things:
That separation prevents an attractive visualisation or a long source list from creating false certainty.
A structured approach improves research in several practical ways.
The same company can be examined for different reasons. An investor may care about beneficial ownership and undisclosed related parties. A procurement team may focus on sanctions exposure, delivery capacity and supply-chain dependencies. A security team may examine exposed infrastructure and executive impersonation risks.
Defining the decision at the outset keeps collection relevant. It also gives the analyst a basis for stopping. Research is complete when it answers the agreed requirement to the available standard, not when the internet has no more pages to inspect.
A source map prompts researchers to check the categories that fit the question rather than relying on familiar websites. In a counterparty review, that may include company records, court databases, procurement portals, sanctions sources, local-language media, archived websites and professional histories.
This does not mean checking every possible source. It means documenting why particular source classes were included or excluded.
Online sources change or disappear. Recording URLs, access dates, relevant extracts, and lawfully preserved copies allows reviewers to trace findings back to the evidence and distinguish verified records from analyst inference.
Researchers can become attached to an early theory. A framework requires them to look for disconfirming evidence, test alternative explanations and record gaps. Peer review adds another check where the consequences of error are material.
Tools are temporary. Research questions and evidence standards are more stable. When a workflow is organised around source types and analytical tasks, a discontinued service can be replaced without redesigning the entire process.
The directory is most useful when the researcher already has a defined question and at least one reliable starting point. Opening random branches to see what appears usually produces irrelevant data and unnecessary privacy exposure.
A starting point might be a legal company name, registration number, domain, email address, username, telephone number, location, document or image. Confirm its spelling, jurisdiction and context before expanding the search.
A weak identifier creates compounded errors. An analyst who begins with the wrong company name may build a detailed but irrelevant network around an unrelated entity.
Use the directory as a source map. A domain investigation may begin with DNS, registration history, certificates and web archives. A company review may begin with business records, public filings and media archives. Image verification may require reverse-image search, metadata inspection and geolocation resources.
The category should follow the intelligence question. The presence of a tool in the directory does not make its output relevant to the case.
Check whether a resource requires local installation, registration, payment or manual URL editing. Then assess what the tool will receive. Uploading a sensitive document, face, email address or unpublished image to a third-party service may disclose the investigation or create a new data-protection issue.
Free tools have costs beyond price. They may log queries, retain uploads, expose the user’s IP address or display incomplete data. Read the current terms and privacy information before use.
Run a known query or compare the output with an authoritative source. Check the update date, coverage and jurisdiction. A people-search service designed for one country may return no useful result elsewhere, while a corporate aggregator may lag behind the official register.
Treat the directory entry as a pointer, not an endorsement. If a tool is unavailable or its collection method is unclear, move to another source.
Document which category and resource were used, the query submitted, the date and the result. Negative searches can matter, but they must be described carefully. “No record found in this database on this date” is defensible. “The person has no record” usually is not.
Discovery tools often identify a lead. Verification should move as close as possible to the original record: the official filing, court document, archived page, original media file or first publication.
This step is essential when a result could affect a hiring decision, transaction, allegation or security response.
The UK and NATO intelligence-cycle model describes functions such as direction, collection, processing, and dissemination, supported by ongoing communication and review. Other organisations may divide the cycle into five or more stages. The terminology and structure vary, but the underlying principles are similar.
The following eight-step workflow fits corporate investigations, due diligence, risk analysis and market research.
Write the question in a form that can be answered. “Research Company X” is too broad. “Identify the natural persons who appear to control Company X, their material sanctions exposure and any undisclosed links to the proposed seller as of the signing date” is specific.
Agree the decision, deadline, jurisdictions, materiality threshold and acceptable confidence level. List known identifiers and assumptions separately.
Define what analysts may collect, how personal data will be handled, which sources are prohibited and when specialist legal advice is required. The scope should reflect purpose, necessity and proportionality.
Authorisation matters. Public technical data may support defensive research, but it does not permit access to a system. A leaked dataset may be discoverable online yet still create legal, security and ethical risks that require specialist handling.
Map the source classes that could answer each part of the requirement. Rank them by likely value, authority, cost, access time and risk.
For an ownership inquiry, the plan may cover current and historic corporate records, beneficial-ownership filings where available, transaction announcements, insolvency records, litigation, procurement data, sanctions lists, professional profiles and local-language reporting. The OSINT Framework directory can help identify tools within those classes.
Search systematically. Record exact queries, filters, dates and identifiers. Capture enough context to show what the material means, not only the line that supports a preferred conclusion.
Preserve source provenance throughout. A screenshot without its URL, timestamp or surrounding text may be difficult to verify later. Where the matter could enter litigation or regulatory review, evidence handling should follow the relevant legal protocol.
Normalise names, dates, addresses, entity identifiers and currencies. Separate people from companies and confirmed identifiers from possible matches. Remove duplicates without deleting the record of where claims appeared.
Translation, optical character recognition and entity extraction can accelerate this stage. Machine output should remain linked to the original-language source so an analyst can check errors and nuance.
Assess each source’s authority, access, motive, recency and consistency. Then assess the claim itself. A primary record may be authoritative for a company’s declared director but not for who exercises informal control.
Look for independent corroboration. Three news stories quoting the same anonymous post are one evidential chain, not three confirmations.
Connect records, events, people and assets. Build timelines where sequence matters. Use link charts when relationships are too complex to explain linearly. Test alternative explanations and actively seek evidence that would disprove the leading assessment.
High-impact findings need peer review. The reviewer should be able to trace each conclusion to the cited material and distinguish fact from inference.
Lead with the answer, its business implication and the level of confidence. Show confirmed findings, material indicators, unresolved gaps and recommended next checks. Do not make the reader reconstruct the conclusion from a data dump.
The recipient’s feedback may change the requirement. New facts can require further collection or a different assessment. Monitoring may continue after the initial report where ownership, sanctions, litigation or threat exposure can change.
No single tool covers the open-source environment. Effective research combines several source classes selected for the case.
Search engines support discovery across websites, documents and indexed databases. Advanced operators can narrow results by domain, file type, title, date or exact phrase. Search results are shaped by indexing, location, language and personalisation, so different engines may return different views.
The Internet Archive’s Wayback Machine can show how a company described its ownership, products or team at an earlier date. An archive may contain gaps or partial captures. Absence from it does not prove that a page never existed.
Official company registers, securities filings, procurement portals, insolvency records and court databases can establish legal facts and declared relationships. Companies House in the UK and SEC EDGAR in the US are examples, but coverage differs sharply by jurisdiction.
Aggregators help find leads across borders. Material conclusions should still cite the underlying record where it is available. This source-selection logic is central to third-party due diligence, where ownership, sanctions, litigation and reputation must be assessed together.
Media archives add context that registers rarely contain. They may identify disputes, political connections, historic conduct, operational failures or market claims. Local and trade publications can surface details missed by large international outlets.
Analysts should distinguish reporting from commentary and original investigation from syndication. Publication reputation is relevant but does not remove the need to inspect sourcing.
Public posts can help establish public statements, affiliations, event attendance, location clues and changes in narrative. They are also vulnerable to impersonation, deletion, coordinated amplification and context collapse.
Identity resolution must come before attribution. A matching name or photograph is not enough. Analysts should compare usernames, biographies, dates, known contacts, employment history and other independent identifiers.
Discovery tools can map where an identifier appears publicly. Their coverage, lawfulness and accuracy vary by country. Some combine public records with brokered or breach-derived data, which can change the legal and ethical assessment.
Use only data relevant to the stated purpose. In employment screening, for example, OSINT in recruitment should remain role-specific, proportionate and subject to applicable privacy and employment rules.
Public DNS records, certificate-transparency data, registration history, archived pages and internet-wide scan data can help identify an organisation’s visible digital footprint. Resources such as ICANN Lookup and the Censys platform can support discovery, subject to current access terms and coverage.
They do not authorise intrusion, authentication attempts or exploitation. Identified exposure should be validated through an approved cyber security risk management process before action.
Maps, satellite imagery, terrain data, street-level imagery, weather records and shadow analysis can help establish where and when material was captured. The Copernicus Browser and Google Earth are common starting points for imagery and historical comparison.
Geolocation normally depends on multiple cues: road layouts, skylines, signs, vegetation, utility infrastructure, shadows and known reference imagery. A single visual similarity is rarely sufficient.
Reverse-image search, keyframe extraction, metadata inspection, compression analysis and document comparison can help identify earlier versions or signs of alteration. Metadata may be useful when present, but platforms often strip it and files can be edited.
The strongest verification combines technical examination with source history, visual context and independent records.
Graph tools such as Maltego and Gephi can show relationships among people, companies, domains, transactions and events. Timelines can expose inconsistencies in career or ownership claims. Maps can reveal geographic concentration or route dependencies.
A visualisation does not strengthen weak evidence. Every node and link should carry a source and a defined relationship. Proximity on a chart is not proof of control, coordination or wrongdoing.
Automation can collect recurring data, compare versions and flag changes. AI can assist with translation, transcription, optical character recognition, entity extraction, clustering, retrieval and summarisation.
These systems can also merge identities, invent citations and flatten uncertainty. The OSINT Framework is a directory rather than an automated investigation platform. AI-assisted OSINT workflows can accelerate processing, but every material result still requires source-level verification.
Some cases involve forums, marketplaces or leak sites that are not indexed by ordinary search engines. Access can expose the researcher to malware, illegal material, monitoring or inadvertent interaction with threat actors.
This work requires an approved purpose, isolated infrastructure, clear handling rules and experienced staff. A list of links is not an operational-security plan.
Choosing the right OSINT tool depends on the research question, not on the tool’s popularity or number of features. Start by identifying the information you need, then compare available resources against five criteria:
A tool that performs well in one jurisdiction may be unsuitable elsewhere. Where findings could affect a transaction, employment decision, or legal assessment, prioritise verifiable evidence over convenience. The OSINT Framework directory can help identify candidates, but selecting and validating them remains the analyst's responsibility.
Advanced work is less about using obscure tools than combining ordinary sources with disciplined analysis.
Effective search begins with an identifier matrix: legal names, former names, aliases, transliterations, registration numbers, addresses, domains and key dates. Analysts test combinations, record successful queries and update the matrix as new identifiers appear.
Searches should include negative and alternative hypotheses. If a company claims it has operated since 2016, an analyst should look for evidence both supporting and challenging that timeline.
Archived websites, historic filings, cached documents and media timestamps can reconstruct how a network changed. This can reveal directors removed before a transaction, product claims that disappeared, changes in contact details or an address shared with related entities.
Dates need careful treatment. A page capture date, document creation date and underlying event date may all differ.
Large document sets can be processed to identify names, companies, places, dates and amounts. OCR can make scanned court files searchable. Named-entity extraction can suggest connections across thousands of pages.
Analysts must review ambiguous entities and the original text. Common names, poor scans and transliteration can create false matches at scale.
Link analysis can identify central actors, intermediaries and clusters. Temporal analysis asks when links existed. A person who left a board ten years ago carries a different implication from a current authorised signatory.
The relationship label should be specific: director, shareholder, co-address, employee, cited associate or transaction counterparty. Generic “connected to” labels conceal uncertainty.
Geolocation identifies where an image or video was captured. Chronolocation estimates when. Analysts compare visual features with maps, imagery, weather, sun position, construction history and other time-bound sources.
The result should state what cues support the assessment and what could change it. Image quality, reused footage and edited timestamps can limit confidence.
Alerts and scheduled collection can track sanctions designations, corporate changes, litigation, media coverage, domain records or website edits. Monitoring is most useful when linked to predefined triggers and an escalation owner.
Without those rules, teams receive an alert stream that nobody interprets. The objective is to detect a change that affects a decision, not to maximise notification volume.
Several adjacent disciplines are often placed under the OSINT label. That creates legal and analytical confusion.
Human intelligence, or HUMINT, comes from people through interviews, debriefings, source relationships and other human interactions. A public speech or published interview can become an open source. Conducting an interview is a human-source collection activity, not OSINT.
OSINT and HUMINT can corroborate each other. They remain different collection disciplines with different consent, source-protection and verification requirements.
Signals intelligence concerns intercepted signals and communications under the relevant authority. It is not a synonym for analysing public domain or IP data. Publicly visible technical records can be OSINT; intercepting private traffic cannot.
Digital forensics examines devices, systems or stored data under proper authority. Network traffic analysis relies on data from networks an organisation owns or is authorised to monitor. Either discipline may use open-source context, but the underlying collection is not OSINT by default.
Bypassing authentication, exploiting a vulnerability, evading access controls or obtaining data through deception is not made lawful because the objective is research. Open-source work should stop where unauthorised access begins.
OSINT is generally lawful when it uses information available under legitimate access conditions. The way an organisation collects, combines, stores and uses that information can still create obligations.
Personal data remains personal data when it appears on a public website. The UK Information Commissioner’s Office states that organisations should not assume data-protection law ceases to apply merely because information is publicly available. Purpose, lawful basis, transparency, minimisation, retention and security may all be relevant.
The correct assessment depends on jurisdiction, subject, source and use. Criminal-record data, special-category data, children’s data and large-scale profiling require particular care.
A page may be visible in a browser while automated collection is restricted by contract, copyright or database rights. Commercial sources may limit redistribution. Teams should record the access basis and permitted use for each material source.
Collect what the decision requires. Do not expand an inquiry into irrelevant private life simply because a tool makes the information easy to find. Apply stricter review where findings could affect employment, credit, safety or reputation.
Queries can disclose an organisation’s interest in a person, company or asset. Use separate, approved research accounts and infrastructure where necessary. Do not upload sensitive client material to unknown services. Treat downloaded files and high-risk links as potential security threats.
Define how long case material will be kept, who can access it and how corrections will be handled. Store the minimum necessary evidence and preserve the source trail for material conclusions.
A structured OSINT methodology is useful when a business decision depends on evidence scattered across jurisdictions and source types.
OSINT can identify ownership, related parties, litigation, sanctions exposure, political connections, operating history and adverse media. It can also test whether an investment target’s public claims match filings, product evidence and market activity.
The output should explain what the findings mean for the transaction. A historic dispute, current enforcement action and unsupported allegation require different treatment.
Supplier records, trade data, procurement filings, sanctions sources, company networks and location evidence can reveal hidden dependencies. The same method supports OSINT for counterparty verification in sectors where licence, ownership and geographic risk affect the deal.
Open sources can help trace assets, map related entities, reconstruct events and identify witnesses or records for lawful follow-up. The analytical question may concern fraud, conflicts of interest, intellectual property, undisclosed control or reputation.
OSINT rarely answers every question alone. It can identify the next record, jurisdiction or human source that merits examination.
Companies can examine product launches, hiring patterns, patents, procurement activity, pricing signals, partnerships and regulatory developments. Business intelligence and advisory work combines these signals with market context and tests them against the decision the client faces.
Ethical competitive intelligence uses legitimate sources. It does not involve misrepresentation, trade-secret theft or unauthorised access.
Public infrastructure data, leaked-credential indicators, impersonation sites and exposed documents can reveal part of an organisation’s external risk. Monitoring can also identify narratives, coordinated activity or fraudulent identities that may affect trust and security.
Technical validation and remediation belong within authorised security processes. An OSINT alert is a lead, not proof that a system is compromised.
Role-relevant checks can verify career claims, public directorships, sanctions exposure, adverse records and material reputation issues. The scope should reflect the role, jurisdiction and access level.
Employers must avoid irrelevant profiling and discriminatory inference. Findings need identity resolution, source verification and a fair review process before they affect a decision.
In defence, finance, energy and other regulated fields, standard screening may miss indirect ownership, cross-border intermediaries or operational dependencies. Selected sources can support defence-sector due diligence by connecting company records, sanctions indicators, trade signals and public digital traces.
The assessment must stay within the commercial and legal mandate. Classified collection, targeting and unauthorised system access are outside OSINT.
Most poor outcomes come from weak research discipline rather than a shortage of tools.
A company needs more than bookmarks. Its framework should connect research to governance and review.
The capitalised OSINT Framework is an online, tree-structured directory of open-source research tools and resources. The phrase can also describe a repeatable methodology for planning, collecting, processing, analysing and reporting open-source intelligence.
The directory is free to access and prioritises resources that provide at least some free functionality. Individual tools may require registration, payment or local installation. Always check the current access terms.
No. It organises links and categories. The researcher selects a resource, submits a query and evaluates the result. It is not a one-click investigation platform.
Many organisations describe the process as direction, collection, processing, analysis and dissemination. UK and NATO intelligence-cycle models group these functions differently. The exact number matters less than maintaining requirements, provenance, verification, review and feedback throughout.
A search engine is a discovery tool used in OSINT. Its results are not intelligence by themselves. Analysts still need to verify sources, resolve identities and connect findings to the question.
OSINT using legitimately available information is generally lawful, but collection and use remain subject to applicable laws, contracts and rights. Public personal data is still regulated. Unauthorised access, prohibited collection or unlawful processing does not become OSINT merely because a browser was involved.
These are informal labels rather than universal stages. Passive collection observes available information without creating a visible interaction with the subject. “Active” is often used for collection that leaves a detectable footprint, such as a query that may notify an account holder. Such steps need explicit authorisation, risk review and clear limits. Interviews and elicitation move into HUMINT rather than pure OSINT.
No. HUMINT collects information from people through human interaction. Public statements and published interviews can be open sources, but conducting an interview is not OSINT collection.
AI can accelerate extraction, translation, search and triage. It cannot take responsibility for source reliability, legal scope, identity resolution or analytical judgement. Material conclusions require human review against the original sources.
The OSINT Framework solves a real discovery problem: it gives researchers an organised route through a large and changing set of tools. Its value is highest when the user already knows the question, access limits and evidence standard.
The directory cannot decide which absence is meaningful, whether two identifiers belong to the same person or how a finding changes an investment, hiring or security decision. Those tasks belong to a documented OSINT methodology and an analyst accountable for the conclusion.
Molfar Intelligence applies open-source research within due diligence, corporate investigations, business intelligence and risk assessments. Our analysts map the relevant sources, test claims against primary records and report what is confirmed, what remains uncertain and what the evidence means for the client’s decision.
Let’s connect to explore how tailored intelligence can strengthen your decisions, reveal opportunities, and minimise uncertainty.
20 October 2026
Molfar Intelligence and IN2 have formalised a strategic partnership combining verified open-source intelligence with behavioural science and analysis of coordinated information threats.
07 October 2026
Advisory board will guide the firm's international growth and strengthen the contribution of private intelligence to international security
.svg)
11 July 2024
OSINT AI is one of the novelties in the domain that will likely stay long. The researchers should remain in the loop and try out AI OSINT instruments to enhance their investigation efforts.
6 July 2024
An advanced open source HR management system is a necessary tool for modern companies to ensure secure hiring. Candidate sourcing is only half the battle for a recruiter or HR.
Let’s connect to explore how tailored intelligence can strengthen your decisions, reveal opportunities, and minimise uncertainty.
Let’s connect to explore how tailored intelligence can strengthen your decisions, reveal opportunities, and minimise uncertainty.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Clarity. Strategy. Security.
Let’s connect to explore how tailored intelligence can strengthen your decisions, reveal opportunities, and minimise uncertainty.
.svg)
