Open-source intelligence (OSINT) is information about threats that is gathered from public sources, such as news websites, social media, public records and company filings. Here, open source means public information. It does not mean open-source software.
OSINT is a part of a threat intelligence platform. Most threat intelligence describes attackers' technical tools, such as their internet addresses. OSINT adds what people are saying and publishing in the open. Software reads large numbers of public posts, news reports and records, and flags anything that may threaten a company. Analysts then check what the software flagged.
Here are three things OSINT finds. The first is false stories. Say a post claims that a bank in Pune is about to freeze its customers' accounts. Within two hours, hundreds of accounts repeat it. OSINT software notices that the same claim is spreading fast, mostly from accounts created that week. It warns the bank. The bank can then post a correction before worried customers queue at its branches.
The second is threats against people and places. For instance, someone may post a threat against a company's chief executive, or against an event the company is holding. Watching for such threats is called protective intelligence.
The third is facts about suppliers. Consider a company choosing a new payment provider. Public records show who owns a supplier, where it is registered, and whether it has been in the news for a breach. A company uses these facts in third-party risk management (TPRM). TPRM checks whether an attack could reach the company through a supplier, such as its delivery partner or payment provider. The same public data helps supply chain visibility tools. For example, news of a port strike warns them that shipments will be late.
OSINT has limits. Public information can be wrong, and one false story can appear in a hundred places. So an analyst checks the original source before the company acts. Social media companies use the same methods in trust and safety investigations, to find groups of fake accounts working together.