OSINT
OSINT is how attackers build their target picture, so it is also the fastest way to see yourself as they do. I use it for attack-surface discovery and to make awareness training concrete.
Updated
Defensive applications
- External attack-surface discovery: forgotten hosts, exposed panels, leaked credentials, cloud storage.
- Executive and key-person exposure review ahead of social engineering or pretexting attempts, including the AI-assisted variants — cloned voices and synthetic video built from public speaking and social footage.
- Supplier and third-party reconnaissance during due diligence.
- Awareness training built from findings about the actual organisation, delivered to 100+ employees in a previous role.
Data-broker and people-search profiles resurface after removal, typically within a few months, so exposure review is a recurring control rather than a single pass — and the highest-value fix is often procedural: verifying payment or access requests through a separately maintained channel rather than the one the request arrived on.
Frequently asked questions
Why does OSINT-based training work better?
Because the examples are about them. Generic phishing slides get forgotten; a slide showing their own exposed data does not.
What has changed recently?
Generative AI has made voice cloning and synthetic video cheap enough to use in routine pretexting, so out-of-band verification through a separately maintained channel now matters as much as the original data-exposure review.
Related
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
OSINT training
Open-source intelligence investigator training: collection methodology, verification, and lawful handling of personal data.
Executive exposure checklist
Printable checklist to review executive and key-person OSINT exposure, including AI-assisted pretexting risk, before social engineering attempts.
OSINT exposure awareness
What OSINT reconnaissance actually finds about an organisation and its executives, how AI voice cloning changes the pretext, and the awareness training that measurably reduces exposure.
Allegro Group
Security work at Europe's largest e-commerce marketplace: cloud security, identity, governance redesign and internal enablement.
Allegro Tech
Internal Allegro Tech speaking, including a Best Presentation award for a security talk.