OSINT methodology

OSINT is not a set of tools. It is a discipline for turning publicly available information into defensible conclusions. The tools change every year; the methodology does not. Every serious open-source investigation — whether it lands in a newsroom, a court filing, a compliance memo, or a peer-reviewed paper — follows the same four phases.

The phases are sequential in spirit but iterative in practice. An analyst almost always loops back from collection to planning, from analysis to more collection, and from reporting to corroborating one last claim. What distinguishes rigorous work from a hunch dressed up as research is that the investigator knows which phase they are in, what it requires, and when it is done.

Read each phase page before starting your first real investigation. Then keep them open as a checklist while you work.

The four phases

1. Phase 1 Planning Define the intelligence requirement, the audience for the output, and the legal and ethical guardrails before any collection begins.
2. Phase 2 Collection Gather data from public sources, preserving provenance, timestamps, and hashes from the moment of acquisition.
3. Phase 3 Analysis Corroborate findings, model alternative explanations, and test each claim against the evidence that would disprove it.
4. Phase 4 Reporting Communicate what the evidence supports, mark what it does not, and preserve the chain back to every source cited.

Before you start

Read the ethics and legal framework. OSINT sits astride several bodies of law — computer misuse, data protection, defamation, privacy — and the rules differ by jurisdiction. The methodology assumes you know what you are allowed to do with the information you collect.

If you are working in a specific field, the domain guides translate each phase into the expectations of your profession. A journalist and a compliance officer both plan, collect, analyse, and report — but they answer to different editors.