What does OSINT stand for?
OSINT stands for Open-Source Intelligence. Open-source intelligence: information gathered from public sources, such as websites, social media, DNS and code repositories, about threats or about your own exposure.
OSINT is intelligence gathered from sources anyone can reach legally: company websites, public DNS records, certificate transparency logs, social networks, job advertisements, code repositories, search engines and published breach data. Defenders use it to learn what an attacker can find out about their organization and to follow threat reports. Attackers use the same sources for reconnaissance before a phishing campaign or an intrusion. Collecting it is usually passive: the target's systems are not touched, so there is little or nothing for the target to detect.
OSINT in practice: an example
Before a penetration test, the tester lists the company's subdomains from certificate transparency logs, reads job advertisements that name the firewall and VPN products in use, and collects employee names and the email address format from a professional network. No packet has been sent to the company, and the tester already knows which products to study and whom a phishing message would target.
What OSINT is confused with
OSINT vs active reconnaissance: what is the difference?
OSINT collection reads public sources and does not touch the target. Active reconnaissance, such as port scanning, sends traffic to the target's systems and can be logged and detected.
OSINT vs closed-source intelligence: what is the difference?
Open-source intelligence is free for anyone to collect. Closed or proprietary intelligence comes from paid feeds, private sharing groups or an organization's own telemetry.
Which exams cover OSINT?
OSINT is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: 1.4 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which activity is OSINT?
- Running a port scan against the company firewall
- Reading the company's public DNS records and job advertisements
- Installing a keylogger on a workstation
- Capturing traffic on the internal network
Show the answer
B. Reading the company's public DNS records and job advertisements. Public records and advertisements are open sources read without touching the target's systems. The other options interact with the target or require access to it.
2. A security team wants to reduce what attackers can learn through OSINT. Which step helps most?
- Removing internal product names and version numbers from job advertisements and public documents
- Increasing the DHCP lease time
- Turning off file integrity monitoring
- Using longer network cables
Show the answer
A. Removing internal product names and version numbers from job advertisements and public documents. OSINT only works on what is published. Reviewing what the organization itself puts in public view removes the details an attacker would use to plan.
Sources: MITRE ATT&CK: Reconnaissance (TA0043); MITRE ATT&CK: Search Open Websites/Domains (T1593); NIST SP 800-150, Guide to Cyber Threat Information Sharing. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.