OSINT (Open Source Intelligence)

What Can OSINT Reveal About a Vendor?

Each type of public record answers a different question about a vendor's exposure. Black Kite's monitoring, for example, builds on these datasets:

• IP addresses and subdomains: What an organization has exposed to the internet.
• Service fingerprints: The software and versions running on exposed systems.
• SSL certificates: Infrastructure relationships and configuration strength.
• DNS and WHOIS records: How domains are registered and resolve.
• Internet traffic flows: How exposed systems communicate.

Together, these records make up an organization's digital footprint, which is the starting point for most OSINT-based vendor risk assessment.

What Counts as an Open Source?

An open source is any overt, publicly available source of information, and intelligence practice groups them into six categories. Those categories are media, internet sources such as blogs and social platforms, public government data, professional and academic publications, commercial data, and grey literature such as technical reports, preprints, and patents.

Open Means Overt and Publicly Available

The "open" in OSINT describes overt, publicly available sources that anyone can access. Open-source software is a separate concept that shares the word, and security teams deal with both regularly.

How Does the OSINT Cycle Work?

OSINT follows an intelligence cycle that turns raw public data into findings someone can act on. Security programs typically run it in six steps:

• Planning: Define the question, such as which vendors run a newly vulnerable product.
• Collection: Gather public records from registries, archives, search engines, and scan data.
• Processing: Normalize and deduplicate the data so records from different sources line up.
• Analysis: Link the findings to a specific organization and judge whether each exposure matters.
• Dissemination: Route findings to the people who can act on them, including the vendor.
• Continuous monitoring: Repeat the cycle automatically as public data changes.

What Separates Passive OSINT From Active Reconnaissance?

Passive OSINT collects information from third-party sources without touching the target's systems, while active reconnaissance probes those systems directly. Passive methods include searching DNS history, web archives, and search engine results. Active methods include intrusive vulnerability scanning and exploitation testing, which go beyond observing what a service presents publicly.

Active Probing Requires Explicit Authorization

Active techniques can trigger security alerts and disrupt services, so mature security teams require formal authorization before using them, even on their own assets. For vendor assessment, that makes passive collection the practical default. It produces evidence about a vendor's exposure without any interaction the vendor would need to approve.

How Does Third-Party Risk Management Put OSINT to Work?

Third-party risk teams turn OSINT into vendor findings by matching public records to a specific vendor's assets and checking those assets for weaknesses attackers exploit. Black Kite's research follows that approach, assessing exposure with non-intrusive methods that take an attacker's perspective and require no questionnaires. The result is an outside-in assessment,built on non-intrusive methods that don’t require access to, or credentials for, the vendor’s systems. Because the data is public and always available, OSINT-based assessment can run continuously throughout the year.

Attackers Start With the Same Public Data

Black Kite's 2026 Supply Chain Vulnerability Report argues that attackers find targets by scanning the internet for exposed systems running known vulnerable software. They use the same OSINT tools available to defenders. The report applies OSINT discoverability as its first filter. Of 1,240 high-priority CVEs the Black Kite Research Group™ analyzed manually, 329 were OSINT-discoverable, and 58 of those were Code Red because their exploitation probability ran above 60%.

How Do Attackers Use OSINT Against Vendors?

Attackers run the same OSINT collection defenders do, and they use it to pick targets, craft phishing, and find ways in. Public sources hand them a surprising amount of reconnaissance:

• Job postings: Listings that name specific firewalls, VPNs, or platforms reveal a company's technology stack.
• Employee details: Names, roles, and email formats from public profiles feed targeted phishing.
• Leaked credentials: Passwords from earlier breaches, traded on the dark web and hacker forums, can still work.
• Brand impersonation: Lookalike domains and phishing pages built from a company's public branding.

The last one is common among the vendors large enterprises share most. The 2026 Third-Party Breach Report found that 80% of the 50 vendors most shared by the Forbes Global 2000 have active phishing URLs impersonating their brands. Defensive OSINT watches for those signals first, which is why sources like hacker forums and honeypots, decoy systems that record attacker activity, belong in the collection mix.

How Is OSINT Different From Threat Intelligence?

OSINT is defined by where information comes from, while threat intelligence is defined by what it's used for. Threat intelligence can combine OSINT with closed sources, such as commercial feeds, internal telemetry, and information shared within trusted communities. OSINT is one input to threat intelligence. It also feeds vendor risk assessment, due diligence, and general investigations.

The distinction matters when reading a vendor finding. An OSINT result shows what's publicly visible about the vendor. Threat intelligence adds the next layer, which is whether any threat actor is targeting that vendor.

Is OSINT Legal and Ethical to Use on Vendors?

OSINT relies on information that can be accessed lawfully, which is what separates it from intrusion or covert collection. Collection still has to respect privacy laws, and assessment methods stay non-intrusive. They observe what's publicly exposed without probing, logging in to, or testing a vendor's systems. That line matters in vendor relationships, since an assessment that touched a vendor's infrastructure without permission would create legal exposure of its own.

What Are OSINT's Limits?

Public data can be stale, incomplete, or wrong, so OSINT findings need validation before anyone acts on them. A record can point to an asset that changed hands, and a service can report a misleading version. An alarming finding can also turn out to be a decommissioned test server. OSINT stops at what's publicly observable, so it can't see a vendor's internal controls, policies, or data handling.

Validation Turns Raw Findings Into Evidence

A finding becomes evidence once it survives three checks. Teams can apply them to any OSINT result before escalating it:

• Cross-source confirmation: Two or more independent sources show the same fact.
• Recency: The data reflects the asset's current state and configuration.
• Vendor confirmation: The vendor verifies ownership and status when a finding drives a decision.

Findings that pass all three checks are ready to share with the vendor as evidence, which shortens the back-and-forth that follows an unverified alert.

How Does Black Kite Use OSINT?

Black Kite's collectors, crawlers, and honeypots feed a data lake that its platform continuously verifies, and it shows only data confirmed across multiple sources. Its risk management methodology validates data with two or more sources to reduce false positives. IIt then translates that data into ratings and financial-impact estimates using MITRE, NIST, and Open FAIR™ standards.

Black Kite's cyber risk monitoring platform covers covers 34M+ companies with >97% data accuracy. OSINT also drives FocusTags®, each of which is applied only when a vulnerability can be identified on external-facing assets using OSINT tools and shows evidence of real-world exploitability.

See also: How to Measure What Attackers Already Know