Organizations spend heavily on detecting attacks in progress. They invest far less in understanding what an attacker learns before the first hostile action ever occurs. This gap — between the moment an adversary selects a target and the moment they make their first intrusion attempt — is where open-source intelligence operates, and it is a phase that almost no organizational defense can observe.

Passive reconnaissance leaves no trace. No firewall log records a Shodan query against your IP space. No SIEM alert fires when someone searches LinkedIn for your employees. No intrusion detection system registers a lookup of your domain in a breach database. The attacker is not touching your infrastructure — they are reading information your organization has already made publicly available, intentionally or not.

Tomislav Vazdar, CEO of Riskoria, frames the problem as an asymmetry that organizations systematically underestimate. “Your perimeter defenses assume the attacker doesn’t already know what’s inside. OSINT invalidates that assumption before the attacker sends a single packet.”

The Credential Layer: Breach Databases as Intelligence Sources

The first resource any competent attacker consults is a breach database. Have I Been Pwned, the most widely used public index of compromised credentials, has catalogued over 1.9 billion unique email addresses from thousands of documented data breaches. A query against a target organization’s email domain takes seconds and returns a list of employee addresses that appeared in known breaches — often alongside the passwords associated with those accounts at the time of the breach.

This matters because of password reuse. The Verizon 2025 Data Breach Investigations Report documented that compromised credentials served as the initial access vector in 22 percent of all analyzed breaches. Infostealer malware analysis cited in the same report found that in the median case, only 49 percent of a user’s passwords across different services are distinct from each other. An employee whose personal email appeared in a LinkedIn breach four years ago may be using a variation of that same password on a corporate VPN today. Furthermore, 54 percent of organizations that experienced ransomware had their domains appear in public credential dumps — most without ever knowing it.

The Technical Surface: What Your Infrastructure Announces

Beyond credentials, the internet-facing technical surface of most organizations is substantially more visible than their security teams realize. Shodan and similar internet-scanning services continuously index publicly accessible devices and services — web interfaces, remote desktop protocols, management panels, industrial control systems — and make them searchable by IP range, domain, port, and service banner.

An attacker querying an organization’s IP space through Shodan doesn’t need to perform any active scanning. Shodan has already done it, catalogued the results, and made them available for free. The query might reveal an RDP port exposed to the internet, a network printer with a web interface and default credentials, or an unpatched version of a web application framework that hasn’t been updated since the organization migrated to a newer system two years ago and forgot to decommission the old one.

Certificate transparency logs compound this exposure. Every publicly trusted SSL certificate issued for any subdomain generates a permanent, public record. Tools like crt.sh index these records, revealing internal subdomains — staging environments, development servers, legacy application endpoints — that organizations never intended to publicize but inadvertently did the moment they provisioned an HTTPS certificate.

The Social Layer: Job Postings as Architecture Documentation

Job postings are among the most underappreciated OSINT sources because organizations don’t think of them as security-relevant disclosures. They are. An active job advertisement for a senior infrastructure engineer that lists required experience with specific firewall vendors, SIEM platforms, and cloud providers is a near-complete inventory of the organization’s security architecture. An opening for a senior finance analyst that lists proficiency with a specific ERP system tells an attacker exactly which software to research for known vulnerabilities.

LinkedIn profiles extend this further. An organization’s LinkedIn presence, aggregated across all employees, typically reveals the complete org chart, approximate tenure and transition dates that identify newly hired employees who haven’t yet completed security training, and which individuals hold privileged access by virtue of their stated roles. Social engineering campaigns built on this foundation don’t require any technical sophistication — they require only that the attacker read what is already publicly visible.

The Defensive Response: Knowing Your Own Exposure

The appropriate organizational response is not to eliminate all public presence — it is to understand it. Running the same OSINT analysis on your own organization that an attacker would run reveals the actual exposure, which is almost always more extensive than IT and security teams estimate. Monitoring your email domain in breach databases on a regular cadence, auditing what Shodan indexes on your IP space, reviewing certificate transparency logs for subdomains that should be decommissioned, and establishing clear policies on what employees may publicly disclose about internal technology are all practical steps that require no specialized tools.

According to IBM’s 2024 Cost of a Data Breach Report, organizations take an average of 204 days to identify a breach. The reconnaissance that enabled that breach may have been completed in an afternoon — and generated no evidence whatsoever. The organizations that narrow this asymmetry most effectively are those that have mapped their own external footprint before the attacker does.

Tomislav Vazdar is CEO of Riskoria, a cybersecurity advisory firm specializing in digital risk, NIS2 compliance, and organizational resilience. For inquiries, contact info@riskoria.eu.

The questions that follow a text like this are usually short and very specific: does this apply to us, by when, and on what basis. The Cyber Security Act Copilot answers them, citing the provision of the Act or the Regulation each answer rests on.