OSINT awareness: reducing the attack surface you publish yourself
Before any technical attack, an attacker reads what you have already published. Across awareness programmes run at this scale, the pattern is consistent: the exposure people worry about is rarely the exposure that matters.
By Piotr Zenon Żabrowski · Published · Updated
What reconnaissance reliably yields
| Source | What it gives an attacker | Reduction |
|---|---|---|
| Professional networks | Org chart, reporting lines, tooling in use from job posts | Guidance on role and stack detail; review job adverts |
| Public code and package registries | Internal hostnames, keys, pipeline structure | Secret scanning and pre-commit hooks; history rewrites where needed |
| Certificate transparency and DNS | Forgotten subdomains and staging systems | Asset inventory reconciled against external discovery |
| Document metadata | Usernames, internal paths, software versions | Strip metadata before publication |
| Photos and short video clips from offices and events | Badges, screens, physical layout, and increasingly enough clean audio for a voice clone | Simple publication rules, not a blanket ban |
| Breach and paste data | Reused credentials for corporate accounts | Monitoring plus phishing-resistant MFA |
Training that changes behaviour
- Use the organisation's own footprint as the material — abstract examples do not land.
- Show the pivot: three public facts becoming a credible pretext for a call or an invoice change.
- Give role-specific rules rather than blanket prohibitions; executives, engineers and recruiters have different exposure.
- Provide a fast, blameless reporting route and celebrate its use.
- Measure recon-derived pretext success before and after, not quiz scores.
- Include a callback-verification drill for finance and executive-support staff — the roles a cloned-voice or deepfake pretext targets first.
Frequently asked questions
Is this the same as a phishing simulation?
No. Simulations measure clicks; OSINT awareness reduces the raw material that makes targeted pretexts credible in the first place.
Do executives need separate treatment?
Yes. Their exposure includes family and travel patterns, and the impact of a successful pretext against them is much higher.
Does AI voice cloning change the threat model?
Increasingly, yes. A short public sample of someone's voice is enough for a cloned-voice call requesting an urgent payment or credential reset, and the pretext no longer needs to be a written message an inbox filter might catch. The countermeasure is procedural, not technical: any request to move money, reset a credential or change payment details gets verified through a second, pre-agreed channel — not the one the request arrived on — regardless of how convincing the caller sounds.
Related
OSINT
Using open-source intelligence defensively: attack-surface discovery, executive exposure including AI-assisted pretexting, and awareness training that changes behaviour.
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
Executive exposure checklist
Printable checklist to review executive and key-person OSINT exposure, including AI-assisted pretexting risk, before social engineering attempts.
Allegro Group
Security work at Europe's largest e-commerce marketplace: cloud security, identity, governance redesign and internal enablement.
ISSA Polska Wrocław
Five talks given at the Wrocław chapter of ISSA Polska between 2022 and 2025: OSINT, threat modeling production LLMs, CloudSec and device code phishing.
Disclosure as a control
Telling users they're talking to AI, and labeling synthetic audio and video, works as an operational defense against AI-accelerated phishing and fraud.