# OSINT: How Attackers Research Your Company Before an Attack

> Most targeted attacks start with public information: your org chart, job ads, suppliers and staff posts. What attackers collect, how it becomes a pretext, and how to reduce it.

- URL: https://www.awarexone.com/research/osint-how-attackers-research-your-company
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026 (updated 2026-09-28)
- Topics: OSINT, Exposure
- Related service: Social engineering and training: https://www.awarexone.com/services/social-engineering

## Short answer

Attackers research your company through public sources such as job adverts, staff profiles, supplier news and company registry records, then use those true details to make a fake request, like a bank-detail change, feel routine. Reduce what you do not need to publish, and never treat knowledge of internal details as proof of identity. Verify through contacts you already hold.

## Summary

- Most targeted attacks start with public information such as job adverts, staff profiles, supplier news and company records, gathered to build a believable story.
- Attackers use true details about your staff, suppliers and schedules so a fake request, like a bank-detail change, feels like routine work.
- Someone who knows internal names, suppliers or invoice cycles has only done research, so never treat that knowledge as proof of identity.
- Reduce what you do not need to publish, such as exact systems in job adverts, direct finance lines and travel posted before a trip.
- Some information, like company registry records, is public by design, so verify every request through a contact you already hold, not one in the message.

In this illustrative scenario, an accounts executive at a logistics company in Shah Alam opens an email that appears to come from the finance director. It names the company's real freight forwarder, mentions the new accounting system the company started hiring for last month, and notes that the director is at a conference in Singapore this week. All of that is true. The finance director did post about the conference. The request is to update the forwarder's bank details before Friday's payment run.

The only false detail is the bank account. Everything else was collected from public sources: a job advert, a LinkedIn post, a supplier's press release and the company's own website. That collection work has a name, open-source intelligence, and it is how most targeted social engineering begins.

This guide explains what OSINT is, which kinds of public information attackers look for, how that information turns into a believable story, and how a business can measure and reduce what it gives away.

Last checked: 28 September 2026.

## What Is OSINT, and How Do Attackers Use It Against a Company?

Open-source intelligence (OSINT) is information gathered from publicly available sources, such as websites, social media, job adverts, news coverage, company registries and data exposed in past breaches. Attackers use it to plan targeted social engineering: they learn who works where, who approves payments or resets, which suppliers you use, how your email addresses are formed and what is happening in the business right now. They then build a pretext, a plausible story that borrows those true details so the request feels routine. You cannot make a company invisible, and you should not try. The practical defence has two parts: reduce the details that are unnecessary to publish, and design verification steps so that knowing internal details never counts as proof of identity.

## 1. What Open-Source Intelligence Actually Means

OSINT means intelligence built from sources anyone can legally access. The word "open" refers to the source, not the intent. Journalists, due-diligence teams, recruiters and security teams use the same public information that attackers do.

What makes it intelligence rather than trivia is aggregation. A single job advert, one staff profile or one supplier announcement is harmless on its own. Put together, they can describe your structure, your systems, your routines and your relationships in enough detail to impersonate someone inside the business.

Security teams often use the MITRE ATT&CK framework as a shared reference for attacker behaviour. Its [Reconnaissance tactic (TA0043)](https://attack.mitre.org/tactics/TA0043/) describes the goal plainly: "The adversary is trying to gather information they can use to plan future operations." At the time of writing, the techniques listed under it include gathering victim identity information (employee names, email addresses, credentials), gathering victim organisation information (departments, business relationships, business tempo, roles), and searching open websites, social media and victim-owned websites. ATT&CK also now lists querying public AI services to aggregate public information, including researching business relationships "to develop plausible pretexts".

## 2. Why Reconnaissance Comes Before Most Targeted Attacks

A mass scam email needs no research. A targeted attack only works if the message fits the recipient's actual job, so the attacker has to learn that job first.

The UK National Cyber Security Centre's guidance on [defending your organisation against phishing](https://www.ncsc.gov.uk/guidance/phishing) says it directly: "Attackers use information freely available on your website and social media accounts (known as your 'digital footprint') to make spear-phishing messages more convincing." It singles out high-profile staff, because their details can be used to craft "whaling" attacks against people with access to valuable assets.

Reconnaissance does not stop at public websites. CISA's guidance on [avoiding social engineering](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks) describes attackers asking questions to "piece together enough information" and, if one source is not enough, contacting another person in the same organisation and using the first answer "to add to his or her credibility". Each small, harmless-sounding detail makes the next request easier.

## 3. The Public Information Attackers Look For

Most of this is published on purpose, for good reasons. None of it is wrong to publish; each item simply answers a question an attacker needs answered.

- Organisation structure: who works in finance, IT support, HR and leadership, who reports to whom, and who joined recently. New starters are less likely to know what normal looks like.
- Job adverts: the software, cloud platforms and internal systems a role will use, and sometimes the name of a project or a system migration. That tells an attacker which vendor to impersonate and which "urgent update" would sound believable.
- Staff social profiles: job titles, responsibilities, colleagues, work anniversaries, travel and interests. MITRE notes social media can reveal "the roles, locations, and interests of staff".
- Supplier and partner relationships: case studies, press releases, logos on a website, and suppliers who list you as a client. These supply the name an attacker pretends to be.
- Email address format: once an attacker knows a few real addresses, they can often work out the rest. MITRE notes employee names can "be used to derive email addresses".
- Credentials exposed in breaches: work or personal passwords leaked from unrelated services. MITRE notes attackers may try to take advantage of "the tendency for users to use the same passwords across personal and business accounts".
- Company registry records: legal name, registration number, registered address, directors and shareholders.
- Event and office photos: conference badges, lanyards, whiteboards, screens and building entrances in the background of a celebratory post.
- Executive media: interviews, podcasts, conference talks and videos. These reveal how a leader speaks and what they care about, and they can supply audio for voice cloning.
- Business tempo: financial year-end, payment runs, public holidays, office moves, leadership changes and announced deals. MITRE lists "business tempo" as a reconnaissance target because timing makes an unusual request plausible.

## 4. How Each Type of Information Can Be Misused, and How to Reduce It

Use this table as a starting point for an internal review. The aim is to remove what is unnecessary and back everything else with a process.

*Common public information, how it can be misused, and practical ways to reduce it*

| Information type | How it can be misused | How to reduce exposure |
| --- | --- | --- |
| Org charts and staff lists | Identify who approves payments, resets accounts or handles payroll, and who is new | Publish roles and a shared contact point rather than full team directories; keep reporting lines internal |
| Job adverts | Reveal systems, vendors and migrations to impersonate | Describe skills and responsibilities, not exact products, versions or internal project names |
| Staff social profiles | Build believable familiarity and pick targets by role | A clear, voluntary digital footprint policy and guidance on work detail, not a ban on professional networking |
| Supplier relationships | Pose as a known supplier to change bank details or send invoices | Agree with key suppliers what each side announces; verify every bank-detail change through known contacts |
| Email address format | Guess valid addresses for phishing and impersonation | Anti-spoofing controls (SPF, DKIM, DMARC) and role-based inboxes for public contact |
| Leaked credentials | Try reused passwords against work accounts | MFA everywhere, phishing-resistant where possible; monitor your domains for breach exposure; unique passwords |
| Company registry records | Name directors convincingly and reference real company details | Treat as permanently public; make sure no process accepts registry facts as proof of identity |
| Event and office photos | Copy badge designs, learn office layout, read screens and whiteboards | Check backgrounds before posting; no visible badges, screens or access points |
| Executive media | Mimic tone, reference real priorities, clone a voice | Keep speaking, but pair it with an executive verification protocol staff know by heart |
| Business tempo and travel | Time a request for when the approver is away or busy | Post travel after the event, not before; keep payment calendars internal |

## 5. How Public Information Becomes a Pretext

A pretext is the story that makes a request feel normal. Verizon's [2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T158/reports/2026-dbir-data-breach-investigations-report.pdf) defines pretexting as a scenario in which "a trusted relationship is built through concocted scenarios to trick the user into taking an action that unknowingly compromises the organization, frequently by voice communications but also seen via email or text messaging".

The 2026 DBIR analysed more than 22,000 confirmed breaches in 145 countries, from incidents between 1 November 2024 and 31 October 2025. It found social engineering was the third most common breach pattern, at 16% of breaches, and it tracked pretexting as a separate initial access route for the first time, at 6% of the breaches where it measured how attackers got in. Those figures describe breaches in Verizon's dataset that were detected and reported, not the odds for any single organisation.

OSINT is what makes a pretext accurate. The attacker does not need to invent much, because the true details do the persuading. A request that names the right supplier, the right system and the right manager, at the right moment in the month, reads as ordinary work. That is why the most convincing pretexts contain very few lies.

> Warning: **Knowing internal details is not proof of identity.** A caller or sender who knows your manager's name, your supplier, your invoice cycle or your staff ID format has shown only that they did some research. Treat those details as neutral, never as confirmation. Verify through a contact you already hold, not one supplied in the message.

The pressure that pushes a request over the line is covered in [the six psychological levers social engineers use](https://www.awarexone.com/research/six-psychological-levers-social-engineers-use), and [why social engineering beats your security stack](https://www.awarexone.com/research/why-social-engineering-beats-your-security-stack) explains why a well-researched request often passes straight through technical controls.

## 6. The Malaysian Angle: Some Exposure Is Public by Design

Some information about a Malaysian company is public because the law and good governance require it. Companies Commission of Malaysia (SSM) records are the clearest example. According to [SSM's company information page](https://www.ssm.com.my/Pages/Product/Company-Information.aspx), a company profile obtained through its authorised portals includes the company's registered and business addresses, nature of business, share capital, directors and officers, shareholders, charges and financial information.

That transparency exists so customers, suppliers and banks can check who they are dealing with. It is not something to hide. It does mean an attacker can name your directors correctly, quote your registration number and refer to your registered address. Your processes should assume they can.

Executives are a particular focus. In May 2026, MyCERT published a ["Boss Impersonation" alert](https://www.mycert.org.my/portal/advisory?id=MA-1439.052026) about emails impersonating C-level executives, sent "primarily to executives' personal (non-corporate) email addresses, such as Gmails", often opening with "Are you in the office?". Sending to a personal inbox bypasses corporate email controls, and it relies on the attacker knowing, or guessing, that personal address. MyCERT's recommendations include verifying requests through alternate channels, avoiding personal email for work, and establishing verification procedures for sensitive requests.

Many SMEs are also closely tied to a public-facing founder who posts on LinkedIn, speaks at events and appears in local media. That visibility helps the business, and it gives an attacker a voice, a writing style and a schedule. Our guides on [AI voice cloning attacks](https://www.awarexone.com/research/ai-voice-cloning-attacks) and [what to do when a video call might be a deepfake](https://www.awarexone.com/research/deepfake-video-call-verification) cover the verification side.

Breach data matters locally too. Since 1 June 2025, section 12B of the Personal Data Protection Act 2010 has required data controllers to notify the Personal Data Protection Commissioner of personal data breaches that cause or are likely to cause significant harm, and to tell affected individuals where that harm applies to them ([PDP breach notification guideline](https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/GP_DBN_ENG.pdf)). If you learn that staff details were exposed, in your own systems or a supplier's, assume attackers may already hold them.

## 7. How to Measure Your Exposure

An exposure review is a structured, authorised look at what your organisation reveals publicly, and how that information could be used against you. It answers one question: what could a stranger learn about us that would make a fraudulent request sound genuine?

Keep it proportionate. The review should focus on the organisation and on what people publish in a work capacity. It is not a licence to build files on employees' private lives, and personal data you collect during it is still personal data. A sensible sequence:

1. Agree scope and authorisation in writing: which entities, domains, roles and sources are in scope, who owns the findings, and how personal data will be handled and deleted.
2. Inventory what the organisation itself publishes: website pages, staff listings, contact details, job adverts, press releases, case studies and downloadable documents.
3. Review what is public about high-risk roles in a work capacity: finance, IT support, HR, executive assistants and leadership.
4. Check what suppliers, partners and event organisers say about you.
5. Check whether your corporate domains appear in known breach data, using a reputable breach-notification service or your security provider.
6. Map each finding to the pretext it would enable, for example "supplier bank change" or "help-desk reset".
7. Prioritise fixes by impact: remove what is unnecessary, and add a verification step wherever something cannot be removed.
8. Repeat on a schedule, and after major events such as a funding round, an acquisition or a leadership change.

## 8. How to Reduce Exposure Without Going Dark

MITRE is candid about the limits here. For gathering organisation information, its listed mitigation says the technique "cannot be easily mitigated with preventive controls" because it happens outside your systems, and that efforts "should focus on minimizing the amount and sensitivity of data available to external parties". Reduce what is unnecessary. Accept the rest.

On your website and public channels:

- Publish role-based contact points (such as accounts or support inboxes) instead of individual direct lines for finance and IT.
- Ask what a visitor genuinely needs, as the NCSC suggests, and cut detail that only helps an attacker.
- Check downloadable documents for internal names, file paths and author details before publishing.
- Set up SPF, DKIM and DMARC so your domain is harder to spoof, which both the NCSC and MyCERT recommend.

In job adverts:

- Describe the skills and responsibilities, not the exact products, versions and internal project names.
- Avoid announcing an upcoming system migration or go-live date in public listings.
- Route applicant contact through a recruitment inbox, not a named manager's address.

For staff:

- Write a short, clear digital footprint policy. The NCSC recommends helping staff understand how sharing personal information can affect them and the organisation.
- Keep it voluntary and practical: professional profiles are normal and useful. Focus on the details that matter, such as who approves what, internal systems, and travel posted in advance.
- Explain the why with real examples, including the supplier bank-change and "boss" scenarios. The UK's National Protective Security Authority publishes [My Digital Footprint](https://www.npsa.gov.uk/security-campaigns/my-digital-footprint) materials built for this.

For executives and public-facing founders:

- Review what is public about home addresses, personal emails, family members and personal phone numbers, and remove what you can.
- Separate personal and business email, and never approve business requests from a personal inbox.
- Share travel after the trip rather than before it.
- Agree an executive verification protocol with finance and assistants, and follow it personally.

Our [digital identity protection](https://www.awarexone.com/digital-identity-protection) work covers the personal side of executive and founder exposure, including impersonation. If someone is already posing as you or your brand, our guide to [collecting impersonation evidence](https://www.awarexone.com/research/impersonation-removal-malaysia) explains what to save.

## 9. Make Public Information Useless as Proof of Identity

This is the control that holds when everything else is known. Even an attacker with your org chart, supplier list and finance director's voice is stopped by a process that accepts none of those facts as authentication.

- Call back on a number already in your directory or supplier record, never the number or link in the message.
- Verify every supplier bank-detail change through the existing supplier-change procedure, whoever asks and however urgent it sounds.
- The help desk resets passwords and MFA only after verification through a documented method, not because the caller knows an employee ID, a manager's name or a start date.
- Require a second approver for payments outside the normal cycle.
- Never treat knowledge of internal projects, colleagues or schedules as confirmation of who someone is.
- Apply the same rules to the CEO as to a new hire, so nobody has to be brave to say "I'll call you back".
- Never share passwords, one-time codes or backup codes with anyone who asks, including someone who appears to be from IT or a senior manager.

## OSINT Exposure Checklist

- We know which roles can approve payments, bank-detail changes and account resets.
- Our website uses role-based contact points for finance and IT.
- Job adverts describe skills, not exact systems, versions or projects.
- Staff have a short digital footprint policy and know how to report a suspicious approach.
- Executives use separate personal and business email and follow the verification protocol.
- SPF, DKIM and DMARC are set up, and MFA is on for every business account.
- Our corporate domains are monitored for breach exposure.
- Supplier bank-detail changes are always verified through known contacts.
- No process accepts internal knowledge as proof of identity.
- We repeat an authorised exposure review at least yearly and after major business events.

## How AwareXone Uses OSINT in Authorised Testing

AwareXone is a Malaysian security company. Our [authorised social-engineering testing and training](https://www.awarexone.com/services/social-engineering) starts with an OSINT baseline of the organisation's public attack surface, using public sources only, so that later simulations reflect what a real attacker could learn about you. Every engagement runs on written authorisation, an agreed scope and an emergency stop contact, and reports do not name individuals. The findings are used to fix processes and footprints, not to catch people out. You can read more about [how we work](https://www.awarexone.com/trust).

Awareness alone rarely closes these gaps; we explain why in [why security awareness training is broken](https://www.awarexone.com/research/security-awareness-training-is-broken).

## Frequently Asked Questions

### Is OSINT legal?

Collecting information from public sources is generally lawful, and journalists, researchers and due-diligence teams do it every day. What an attacker does with it, such as impersonation, fraud or unauthorised access, is not. For organisations reviewing their own exposure, personal data collected along the way is still subject to data protection law, including Malaysia's Personal Data Protection Act 2010, so keep the review scoped, documented and proportionate.

### What is the difference between OSINT and social engineering?

OSINT is the research: gathering public information about a company and its people. Social engineering is the manipulation: using a story to persuade someone to reveal information, grant access or move money. In targeted attacks, OSINT usually comes first and supplies the true details that make the social-engineering request convincing. Reducing public exposure makes the story harder to build; verification processes stop it even when the story is good.

### Are LinkedIn profiles a security risk?

A profile is not a risk on its own. Professional networking is normal and useful. The risk comes from combining details across many profiles: who works in finance, who is new, who reports to whom and who is travelling. Instead of banning profiles, give staff simple guidance on what to leave out, such as approval responsibilities, internal systems and travel posted in advance, and a safe way to report suspicious connection requests.

### How do attackers work out our email address format?

Email addresses often follow a predictable pattern based on names, so a few real addresses from a website, a document or a public post can reveal the pattern for everyone. That is why a known format should never be treated as a secret. The practical defences are role-based inboxes for public contact, anti-spoofing controls such as SPF, DKIM and DMARC, and staff who verify unusual requests regardless of which address they came from.

### Why do attackers care about leaked passwords from unrelated websites?

Because people sometimes reuse passwords across personal and work accounts. A password leaked from a shopping site or forum years ago may still work somewhere else. Leaked data also confirms names, email addresses and phone numbers that make a pretext more believable. Turn on MFA for every business account, prefer phishing-resistant methods such as passkeys or security keys where available, and monitor your corporate domains for breach exposure.

### How often should we review our public exposure?

At least once a year is a sensible baseline, plus after events that change what is public or what is plausible: a funding round, an acquisition, a leadership change, a new major supplier, an office move or a system migration. Each of these creates new public information and new believable reasons for an urgent request. Keep the review short and focused on which pretexts have become easier.

### Who in the company is most exposed to OSINT-based attacks?

Usually the people who can move money, change records or grant access: finance and accounts staff, IT support and help-desk teams, HR and payroll, executive assistants and senior leaders. New starters in those roles are especially exposed because they are still learning what a normal request looks like. That is where verification rules, role-specific guidance and authorised simulations tend to have the most effect.

### What should staff do if someone calls asking about internal details?

Be polite, share nothing beyond what is already on the public website, and offer to call back through the main switchboard or a known contact. Questions about who approves payments, which systems the company uses or when a manager is travelling are worth reporting, even if they seem harmless. Reporting early helps the security team spot a pattern before the real request arrives.

## Official sources

- [MITRE ATT&CK: Reconnaissance, Tactic TA0043](https://attack.mitre.org/tactics/TA0043/)
- [MITRE ATT&CK: Gather Victim Org Information, T1591 (mitigation M1056)](https://attack.mitre.org/techniques/T1591/)
- [Verizon: 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T158/reports/2026-dbir-data-breach-investigations-report.pdf)
- [NCSC: Phishing attacks, defending your organisation](https://www.ncsc.gov.uk/guidance/phishing)
- [CISA: Avoiding Social Engineering and Phishing Attacks (February 2021)](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks)
- [NPSA: My Digital Footprint campaign](https://www.npsa.gov.uk/security-campaigns/my-digital-footprint)
- [MyCERT: "Boss Impersonation" Scam Email alert, MA-1439.052026 (12 May 2026)](https://www.mycert.org.my/portal/advisory?id=MA-1439.052026)
- [Companies Commission of Malaysia (SSM): Company Information](https://www.ssm.com.my/Pages/Product/Company-Information.aspx)
- [Personal Data Protection Commissioner: Guideline on Data Breach Notification](https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/GP_DBN_ENG.pdf)
- [Personal Data Protection Department: Data Breach Notification user manual (2026), effective date 1 June 2025](https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/02/Manual_Pengguna_DBN_English_ver1.pdf)

---

AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.