Practitioner-led by an instructor with both commercial and public-sector intelligence experience. We cover the toolset (search techniques, social media intelligence, corporate records, geospatial sources), the verification discipline that distinguishes intelligence from rumour, and the analytical frameworks that turn raw information into useful conclusions.
Senior managers, investigators, due-diligence professionals, journalists, competitive intelligence analysts, fraud investigators, HR background-check professionals and anyone whose work depends on assembling accurate pictures of organisations, individuals or topics from public information.
Advanced search techniques (Google dorking, specialised search engines), social media intelligence (lawfully), corporate records (Companies House, equivalents internationally), property and land registries, court records, archived web content. The working sources used by professional researchers.
The verification techniques that distinguish intelligence from gossip: source triangulation, primary vs secondary sourcing, image and video provenance (reverse image search, EXIF, geolocation cross-checking) and the analytical frameworks (Analysis of Competing Hypotheses) that resist confirmation bias.
The UK legal framework around OSINT work — Computer Misuse Act, Data Protection Act, RIPA, the limits of lawful collection. Plus the operational-security disciplines that protect both the researcher and the integrity of the investigation.
The open-source tools professional investigators use: theHarvester and Recon-ng for domain and email footprinting, SpiderFoot for automated scanning, Sherlock, Social Analyzer and PhoneInfoga for username and phone pivots, and Maltego for link analysis. You'll see when each tool earns its place, what its output really means, and how to verify it.
By the end of the day you'll be able to:
Before you book: None for most of the day. Some tools run from the command line; these are demonstrated step by step. Not sure it's the right level? Take the one-minute self-check.
Pairs well with:
Good OSINT follows a disciplined path: protect yourself, discover, pivot, then link and grade what you've found. Select any stage to jump to it.
The open-source tools you'll see in action on the course. Choose a tool to watch what goes in, what comes out, and what to check before you trust it.
Domain and email footprinting
Queries public sources such as search engines, certificate transparency logs and DNS data to collect the email addresses, subdomains, hosts and IPs linked to a domain.
Best for: A fast first look at an organisation's public footprint, including your own.
Watch out: Results depend on which sources you query, and some need API keys. Old or recycled addresses turn up often.
theHarvester project page$ theHarvester -d example.com -b crtsh,duckduckgo -l 200[*] Target: example.com[*] Searching crtsh.[*] Hosts found: 4 dev.example.com mail.example.com shop.example.com vpn.example.com[*] Emails found: 2 info@example.com j.morgan@example.comIllustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Modular reconnaissance framework
A Python framework with installable modules for domains, hosts, contacts and more. Results are stored in a workspace database, so each module builds on the last.
Best for: Repeatable, documented investigations where you want every step recorded.
Watch out: Many modules need API keys from third-party services. It rewards a little patience to learn.
Recon-ng project page[recon-ng][acme] > marketplace install recon/domains-hosts/hackertarget[recon-ng][acme] > modules load recon/domains-hosts/hackertarget[recon-ng][acme][hackertarget] > options set SOURCE example.com[recon-ng][acme][hackertarget] > run-----------EXAMPLE.COM-----------[*] Host: vpn.example.com[*] Ip_Address: 203.0.113.10[*] Host: mail.example.com[*] Ip_Address: 203.0.113.25SUMMARY: 6 total (6 new) hosts found.Illustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Automated OSINT scanning
Runs 200+ modules against a target (domain, IP, email, name or username) and correlates the results, with a web interface for exploring what it found.
Best for: Broad, automated sweeps and attack-surface reviews where you need coverage fast.
Watch out: Volume is the challenge. Use passive scans by default, and expect to filter out noise.
SpiderFoot project page$ python3 sf.py -s example.com -u passive[*] Starting scan: example.com (passive)sfp_dnsresolve IP_ADDRESS 203.0.113.10sfp_crt INTERNET_NAME vpn.example.comsfp_whois DOMAIN_REGISTRAR Example Registrarsfp_email EMAILADDR info@example.comsfp_haveibeenpwned EMAILADDR_COMPROMISED info@example.com[*] Scan complete: 214 eventsIllustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Username search across hundreds of sites
Checks whether a username is registered on hundreds of social networks and websites, and lists the profile URLs it finds.
Best for: Quickly seeing where a handle appears so you can review each profile.
Watch out: A matching username isn't the same person. Expect false positives and verify every hit.
Sherlock project page$ sherlock jdoe_example[*] Checking username jdoe_example on:[+] GitHub: https://www.github.com/jdoe_example[+] Reddit: https://www.reddit.com/user/jdoe_example[+] Strava: https://www.strava.com/athletes/jdoe_example[+] Chess: https://www.chess.com/member/jdoe_example[*] Search completed with 4 resultsIllustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Profile detection with confidence scores
Searches for a person's profiles across 1,000+ sites and gives each match a detection rate, with an option to pull profile metadata.
Best for: Prioritising which candidate profiles are worth a closer look.
Watch out: The rate is a guide, not proof. A low-rated hit can still be right, and a high one wrong.
Social Analyzer project page$ social-analyzer --username "jdoe_example" --metadata --top 100[Info] Checking top 100 websites[detected] github.com/jdoe_example rate: 100%[detected] gitlab.com/jdoe_example rate: 86%[unknown] forum.example.org/u/jdoe rate: 42%[Info] 2 detected, 1 unknownIllustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Phone number intelligence
Standardises a phone number and reports what's knowable about it, such as country, area and line type, then helps you search for public footprints of that number.
Best for: Checking whether a number on an invoice, profile or website is plausible.
Watch out: It reports what's knowable about a number, not who owns it. Numbers are often ported or recycled.
PhoneInfoga project page$ phoneinfoga scan -n "+44 29 2018 0000"Running scan for phone number +442920180000...Results for localRaw local: 02920180000Local: 029 2018 0000E164: +442920180000Country: GB# Ofcom reserves this number range for TV and radio dramaIllustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Graphical link analysis
Turns entities such as domains, emails, people and companies into an interactive graph. 'Transforms' fetch related data and draw the connections for you.
Best for: Seeing relationships hidden in a spreadsheet, and presenting them to decision-makers.
Watch out: Graphs can suggest links that aren't real. Every edge needs a source behind it. The free Community Edition has limits.
Maltego websiteIllustrative example with fictional data (example.com, documentation IP ranges, an Ofcom drama number).
Real investigations built entirely from public information, and what they mean for an ordinary organisation. We unpick the methods behind cases like these on the day.
Strava published a global heatmap of its users' activity. In remote regions, the bright traces of soldiers' runs outlined military bases and patrol routes, including in Syria and Afghanistan.
Your staff's apps and posts can reveal patterns you'd never publish. Run OSINT on your own organisation before someone else does.
Researchers geolocated photos, videos and social media posts to trace a Buk missile launcher's route from Russia into eastern Ukraine and back. The Dutch-led Joint Investigation Team later reached the same conclusion about the launcher's origin.
Many weak, individually verified sources can build a conclusion that stands up to official scrutiny, if the method is transparent.
When the authenticity of a video showing an unlawful killing in Cameroon was disputed, the team matched the mountain ridgeline to satellite imagery to find the location, and used the length of shadows to estimate the date and time.
Claims of 'fake' can be tested. Location and time are often verifiable from details hiding in plain sight.
A new supplier passes basic checks. OSINT shows its domain was registered three weeks earlier, the address is a virtual office, a director is linked to several dissolved companies, and the 'case studies' on its website reuse stock photos.
An hour of structured OSINT before signing can prevent months of cost. Every finding was public.
The final case is a composite scenario, based on findings common in supplier due diligence.
Five quick questions, about a minute. You'll get an honest read on whether Open Source Intelligence Gathering fits where you are now, and which parts of the course will help you most.
If you've been made redundant or are facing redundancy in Wales, the Welsh Government's ReACT+ scheme can fund up to £1,500 toward this course — plus childcare, travel and accommodation expenses. We'll handle the application.
Gain practical open source intelligence (OSINT) skills to collect, verify and analyse publicly available information effectively. Learn ethical research techniques that enhance investigations, support informed decision-making and improve due diligence, risk management and business intelligence capabilities.
Our conference room is purpose-built for effective training — bright, modern, and fully equipped for workshops, seminars and accredited sessions.
Llynfi Enterprise Centre
Learn how to locate, collect and evaluate publicly available information using ethical and structured open source intelligence techniques.
Build practical skills to verify information, identify relevant sources and transform data into meaningful intelligence for business and investigative purposes.
Discover how OSINT techniques can strengthen due diligence, risk assessment, competitive awareness and strategic planning while maintaining legal and ethical standards.
Three things we hear before almost every Open Source Intelligence Gathering course, and what's actually true.
If it's public, I can use it however I like.
Public isn't the same as unrestricted. Personal data you collect is still covered by UK GDPR, and public bodies may need authorisation under RIPA for repeated monitoring.
The tools do the investigating.
Tools find candidates. A username match on twenty sites can be twenty different people. Verification is where the real work happens.
Nobody notices who looks at their profile.
Some platforms show viewers, and logged-in searches leave traces. Researcher OPSEC protects both you and the investigation.
Quick answers to what most people ask before booking. Still need help? Get in touch.
Our Bridgend venue is purpose-built for working learning — bright, modern, configurable for cohorts of four to twelve, with quality AV throughout and free parking right outside.
Llynfi Enterprise Centre · Bridgend · More about our venue →
Open Source Intelligence (OSINT) is the process of finding, assessing and analysing information from publicly available sources. This practical OSINT course, run near Cardiff and live online across the UK, introduces the techniques used to conduct effective online research, verify information and turn open-source material into useful intelligence. It is designed for professionals who need to research people, organisations, markets, risks or emerging issues in a structured and responsible way.
Learn what open-source intelligence is, how it differs from ordinary online searching and how publicly available information can be used to answer research questions.
Develop practical research techniques for finding relevant information across websites, public records, news sources, social platforms and other openly available resources.
Learn how to assess sources, cross-check information, identify inconsistencies and distinguish reliable evidence from inaccurate, misleading or outdated information.
Explore how to organise, analyse and communicate findings so that research becomes useful intelligence that can support business, risk and strategic decision-making.
Understand the importance of privacy, legality, ethics and responsible research when working with publicly available information in professional environments.
Develop practical intelligence-gathering skills that can support businesses and organisations across Cardiff and Wales with research, due diligence, market intelligence, risk assessment and informed decision-making.
Courses that build on this OSINT course, or that intelligence and investigation teams often take as a sequence.
Book Open Source Intelligence Gathering for £275 a seat, or send us a brief and we'll come back with a tailored in-house quote for your team within two working days.
