01 / 06

Cyber · AI · Digital intelligence

Strategic intelligence & OSINT

Detect useful signals, understand an ecosystem and document what can genuinely influence a decision.

Empty OSINT desk with maps, monitors and an intelligence dossier Illustration · fictional scene

Effective intelligence is not a pile of results. It organises sources, tracks change, corroborates signals and shows what needs action, verification or continued monitoring.

01

What the assignment should give you

  1. 01A structured view of the monitored ecosystem
  2. 02Signals qualified by confidence and impact
  3. 03Faster decisions supported by traceable sources

How the assignment works

How the assignment works

A short, explicit process adapted to the sensitivity of the situation.

  1. 01

    Scoping

    We define the decision to support, relevant assets, constraints, authorised sources and required confidentiality.

  2. 02

    Investigation

    Collection and analysis follow the agreed scope. Facts, hypotheses and areas of uncertainty remain clearly separated.

  3. 03

    Prioritisation

    Each finding is assessed by reliability, likely impact and the effort required to act.

  4. 04

    Delivery

    You receive a readable synthesis, useful evidence and a roadmap that can be put into practice.

Possible deliverables

Possible deliverables

  • Source, actor and dependency mapping
  • One-off or recurring intelligence brief
  • Sourced timeline and weak signals
  • Executive brief with priorities

Common situations

Common situations

  • Market entry or competitive monitoring
  • Regulatory or technological change
  • Reputation, influence or hostile narratives

How can the assignment’s result be verified?

Use these examples to agree on a verifiable deliverable. Checks and thresholds follow the agreed scope; the examples below are not client results.

Example evidence and decisions to agree during scoping
What to checkEvidence to requestDecision it supports
Signal originFirst publication, author or organisation, link, publication date and observation date; copies grouped together.Exclude repetition effects before judging the signal’s importance.
TimelineEvent date separated from publication and collection dates; known timezone and precision.Compare events in the right order without treating a repost as a new event.
ConfidenceCorroboration, contradictions and relationships between sources; reasons for the assigned confidence.Choose further verification when sources are not independent.
Useful alertTrigger, recipient, review frequency and evidence that would invalidate the analysis.Assign an action or keep monitoring rather than accumulate notifications.

Put the decision to the test

Twelve publications are not twelve confirmations

A team must decide whether to alert procurement about a reported factory closure. It has twelve publications, but the relationships between them change how the evidence should be read.

Fictional teaching case. Figures explain the reasoning; they are neither client results nor thresholds required by a standard.

articles found
12
copies of one press release
9
other publications with no direct confirmation
3
Three possible decisions
Possible choiceMissing evidence or supporting reason
Alert on a confirmed closurePublication volume proves neither source independence nor an actual closure.
Dismiss the signal as falseLack of confirmation is not enough to disprove a closure.
Open a targeted verificationKeep the signal unconfirmed, identify the affected site and seek dated confirmation.
Read the decision and next check

Targeted verification is the proposed decision. The press release is the original source; of the twelve articles found, nine repeat it and three provide no direct confirmation. The file does not count these publications as independent confirmations.

The next check

Trace a decisive claim through every link to its origin. Look for contradictory evidence and record whether it would change the recommendation. An unavailable source becomes an explicit limit, never a confirmation.

What this case does not demonstrate

Mapping repeated publications reveals editorial dependence; it does not by itself prove the original claim true or false.

References and scope

  • Berkeley / OHCHR — Berkeley Protocol

    Its collection, preservation and verification chapters inform traceability. This protocol addresses investigations of human rights violations; it is not a commercial intelligence certification.

References checked on 15 October 2026.

Before the assignment

Frame a useful decision

Scoping separates ongoing monitoring, one-off research and verification of a claim. It fixes the actors, languages, territories, dates and authorised source types so collection remains tied to a decision. The expected output is an intelligence brief proportionate to the decision: entity identities, dated facts, independent sources, contradictions and open checks. Ongoing monitoring defines keywords, exclusions, frequency and alert thresholds. Value comes from explaining why a signal calls for action, further verification or continued observation.

Information to gather

  • Decision or risk to illuminate and time horizon
  • Initial actors, aliases, markets or events
  • Known sources, confidentiality constraints and expected evidence level

Decisions to prepare

  • Which signals trigger deeper verification?
  • How often should the source map be reviewed?
  • Who receives an alert and in what format?
  • Which public signals are independent, verified cases?

Illustrative assignment

Situation
An organisation needs to know whether a new partner has a documented public risk before committing.
Work
Define entities and dates, trace primary publications, exclude reposts and seek direct confirmation for contradictions.
Deliverable
A dated brief separates facts, hypotheses and unknowns and states what would change the recommendation.

Example acceptance criteria to agree during scoping

  • Important conclusions trace back to dated original sources.
  • Reposts are not counted as independent sources.
  • The dossier names unknowns and facts that could change the decision.
Related public methods

References: data, uses and limitations

Documentation reviewed on .

References: data, uses and limitations
Source and purposeVerified data or benchmarkHow to use itLimitation to retain
OASIS · STIX 2.1

Describe threat intelligence through structured objects and relationships.

 STIX 2.1 is an OASIS Standard dated 10 June 2021. It defines objects, properties and JSON serialisation. Keep identifiers, dates, provenance and relationships. Check that the recipient interprets the same object type and validity period.

Explore the method →

 A syntactically valid object can still be stale, misattributed or weakly supported.
C2PA · Content Credentials

Describe and verify certain content provenance information.

 C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media. Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.

Explore the method →

 Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
ICANN · Registration Data Lookup

Consult available domain registration information.

 RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data. Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.

Explore the method →

 Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.

Media provenance and C2PA validation

Separate technical trace, source and judgment

Verifiable provenance helps describe a file’s history. Analysts must still check contextual claims and the independence of documents repeating them.

  • Associate each claim with its exact asset and source.
  • Trace repetitions to origins before describing corroboration.
  • Retain uncertainty and information that could change the judgment.

Open the C2PA explorer and publication cases →

References consulted on · C2PA · Content Credentials Explainer ODNI · ICD 203, Analytic Standards

STIX indicators and TLP sharing

Qualify the source before using an indicator

Structured intelligence retains provenance and a version history. For an actionable OSINT note, separate collected facts, the producer’s assertion and the local conclusion, then state what still needs confirmation.

  • Distinguish the declared object creator from the service relaying it.
  • Compare versions, validity window and any revocation before reusing an old indicator.
  • Present producer confidence as a contextual assessment, including its limits and available independent corroboration.

Read the STIX, observations and TLP sharing reference →

Sources checked on · OASIS · STIX 2.1

OSINT: evidence preservation

Usable intelligence retains the trail of its supporting material

Connect each conclusion to sources, preserved objects and working transformations. Custody complements corroboration; it does not turn unverified information into established fact.

  • Describe observed scope, capture limits and date uncertainty.
  • Separate preserved reference, technical copy and assessment extract.
  • Expose unconfirmed transfers and analytical assumptions.

See copy lineage and the eight preservation cases →

Sources reviewed on · NIST · Digital Evidence Preservation · NIST IR 8387 · Full report · NIST · SP 800-86 · NIST SP 800-86 · Full report · NIST · FIPS 180-4 · Secure Hash Standard

Timelines: UTC and time zones

A displayed date cannot by itself order sources

Collection can encounter repeated local times or receive a publication late. Preserve original text, offset, zone and observation traceability before constructing an OSINT timeline.

  • Seek clarification when one local time has two possible instants.
  • Retain the time-zone rule version used for conversion.
  • Separate computed temporal order, clock quality and causal interpretation.

Read the 12 cases and three dated snapshots →

Sources reviewed on · IETF · RFC 3339 · Python · PEP 495 · Python 3.12 · zoneinfo · IANA · Time Zone Database 2026e · IANA · 2026e Europe rules · OpenTelemetry · Logs Data Model

Pagination: consistency and recovery

Reconcile collection identities and revisions

An exit inventory or OSINT collection can reach the last page while missing an object or mixing its revisions. A total alone does not establish that expected data is present.

  • Fix order, scope and consistency reference before reading.
  • Compare IDs and revisions beyond row counts.
  • Retain discrepancies and recovery decisions when the reference changes.

Compare computed reads and recoveries →

Sources reviewed on · Google · AIP-158 Pagination · PostgreSQL 18 · LIMIT and OFFSET · PostgreSQL 18 · Row constructor comparison · PostgreSQL 18 · Transaction isolation · OWASP · API1:2023 Broken Object Level Authorization

IANA references and DNSSEC interpretation

DNS evidence alone cannot attribute a website

An authenticated DNS response concerns zone data in a trust chain. It does not by itself identify the organisation deciding what content is published.

  • Keep queried name, type, time, resolver and observed response.
  • Separate RDAP registration data, hosting, DNS publication and editorial content.
  • Reconcile independent evidence and preserve unresolved points.

Read the registries and try the cache model →

IETF · RFC 4033 · §3–5 · 2026-10-23

TLS certificates and open-source intelligence

A TLS trace alone does not identify the responsible party

A certificate associates names and a key in an issuance context. Shared hosting, suppliers, renewals and ownership changes require dated corroboration.

  • Attach each assertion to its source object.
  • Retain competing hypotheses and dates.
  • Express confidence without turning a lead into a certain identity.

Read the CT dossier and dated log list →

Google Chrome · Certificate Transparency for Site Operators · Domain Privacy · consulted 2026-10-23

RDAP: registration, roles and redacted data

RDAP: qualify the role before naming an actor

Registrar, registrant and technical contact answer different questions. A public registration response is dated and may contain unpublished data.

  • Read declared roles instead of matching names alone.
  • Separate registration, change, synchronisation and collection dates.
  • Retain redactions and access limitations without inventing the missing identity.

Open the RDAP dossier and local reader →

IETF · RFC 9083 · RDAP JSON Responses · June 2021 · §§4–5, 9–10

Citation chains and social monitoring

Social monitoring: from reposts to a decision

Visible volume alone does not explain reputation risk. Document shared sources, collection scope and actually observed effects before recommending a response.

  • Separate messages, documents and people: the units are not interchangeable.
  • Prepare an Actor, Behaviour, Content, Degree, Effect briefing with explicit unknowns.
  • Set a review deadline, including when the decision is to monitor without responding.

Read the method and explore citation chains →

Government Communications · RESIST 3 · RESIST 3 · 2025 · consulted 2026-10-23

Government Communications · RESIST 3 quick reference · RESIST 3 · 2025 · consulted 2026-10-23

Join cardinality, NULL and aggregates

Read the cardinality behind a published number

When a result combines sources, ask what one row represents and how keys were matched. An apparently correct sum can conceal two offsetting errors. Pair counts and identifier coverage provide additional evidence.

  • Document population before and after joining.
  • Do not infer causation from the total alone.
  • Connect the metric definition to actual retained rows.

Inspect pairs and aggregates in the workshop →

PostgreSQL 18 · Table expressions · PostgreSQL 18 · documentation reviewed 2026-10-23

PostgreSQL 18 · Aggregate functions · PostgreSQL 18 · documentation reviewed 2026-10-23

PostgreSQL 18 · Comparison functions · PostgreSQL 18 · documentation reviewed 2026-10-23

FAQ

Frequently asked questions

Practical answers to help frame the need before an initial conversation.

What is the difference between monitoring, OSINT research and due diligence?

Monitoring follows an environment over time. OSINT research answers a defined question from open sources. Due diligence checks a third party or situation before a consequential decision. One assignment may combine all three.

Are sources and confidence levels visible?

Yes. Useful information is linked to its source, dated and qualified. The deliverable distinguishes confirmed facts, credible signals, hypotheses and unknowns.

When should an intelligence conclusion be reopened?

When a decisive source is corrected, contradictory evidence appears, or the actor, territory or period no longer matches the dossier. Revisit the precise claim, retain its earlier version and explain what changes the decision. Another copy of the same announcement is not independent confirmation.

OSINT guide: produce reliable decision intelligence

UC Berkeley / OHCHR — Berkeley Protocol

Services

02Cyber exposure review 03Applied AI & agents 04Due diligence & digital trust 05Secure, high-performance web 06SEO, AEO & GEO visibility