OSINT Glossary

45 open-source intelligence terms explained in plain English, for students, journalists, researchers and anyone learning OSINT. Link to any term with its own anchor.

By Marie-Soleil Seshat Landry, OSINT analyst · ORCID · Updated Oct 21, 2026

A

Admiralty Code

A two-part grading system for intelligence, also called the NATO system. Source reliability is rated A (completely reliable) to F (cannot be judged), and information credibility 1 (confirmed by other sources) to 6 (cannot be judged).

Analysis of Competing Hypotheses (ACH)

A structured analytic technique that lists every plausible explanation and tests each against all the evidence, looking for what disproves a hypothesis rather than what supports it.

Archiving

Saving a copy of a web page or file at a known time, for example with the Wayback Machine or archive.today, so a finding can be checked after the original changes or disappears.

Attack surface

Everything about an organization that an attacker could find and use: domains, exposed services, leaked credentials, documents and staff information. See attack surface mapping.

B

Beneficial ownership

The real people who ultimately own or control a company, as opposed to the nominees or holding companies listed on paper.

C

Certificate transparency

Public logs of every TLS certificate issued for websites. Searching them (for example on crt.sh) reveals a domain’s subdomains.

Chain of custody

A documented record of how evidence was collected, stored and handled, so its integrity can be shown later.

Chronolocation

Working out when a photo or video was taken, using shadows, weather, seasonal clues, satellite imagery and known events.

Collection plan

The list of questions an investigation must answer and the sources that will be used to answer each one.

Confidence level

A statement of how much an analyst trusts a judgment (low, moderate or high), based on the quality and quantity of the evidence.

Coordinated inauthentic behaviour

Networks of fake or misleading accounts working together to manipulate public debate while hiding who is behind them.

Corroboration

Confirming a claim with at least one other independent source that did not simply copy the first.

D

Data broker

A company that collects and sells personal information. Many offer opt-out forms, which are part of a digital footprint audit.

Deepfake

Synthetic audio, image or video generated or altered with AI to show something that did not happen.

Digital footprint

All the information about a person or organization that can be found online, whether shared deliberately or not.

Disinformation

False information spread deliberately to deceive.

Doxxing

Publishing someone’s private personal information, such as a home address, to expose or intimidate them. Ethical OSINT does not do this.

E

Estimative language

Standard words that express probability in analysis, such as “almost certainly”, “likely”, “roughly even chance” and “unlikely”.

EXIF metadata

Information embedded in photo files, which can include the camera, time and GPS location. Most social platforms remove it on upload.

F

FININT

Financial intelligence: analysis of financial records and flows, such as company filings, sanctions lists and leaked financial data.

G

GEOINT

Geospatial intelligence: analysis of imagery and location data. See GEOINT Basics.

Geolocation

Establishing exactly where a photo or video was taken by matching its features to maps and satellite or street-level imagery.

H

Hash

A unique fingerprint of a file, such as a SHA-256 value. If the file changes, the hash changes, which proves a preserved copy has not been altered.

HUMINT

Human intelligence: information obtained from people. Lawful HUMINT is open, identified and consent-based, such as interviews with people who choose to speak.

I

IMINT

Imagery intelligence: analysis of photographs, satellite and aerial imagery.

Intelligence cycle

The repeating process of planning, collection, processing, analysis, dissemination and feedback that turns information into intelligence.

K

Key assumptions check

A structured technique for listing and challenging the assumptions an analysis depends on.

L

Legal espionage

Marie Landry Spy Shop’s term for intelligence work done only by lawful means: OSINT analysis and open, consent-based HUMINT. A figure of speech, not espionage in the legal sense.

M

Malinformation

Genuine information shared out of context or to cause harm.

Misinformation

False information spread without the intent to deceive.

O

OPSEC

Operational security: protecting your own identity, methods and data while you research.

OSINT

Open-source intelligence: intelligence produced by collecting, verifying and analyzing information that is lawfully and publicly available.

P

Passive reconnaissance

Gathering information about a system or organization without interacting with it directly, for example by reading public records and certificate logs rather than scanning.

Pretexting

Pretending to be someone else to obtain information. It is deception, not research, and can be illegal.

Provenance

Where a piece of information came from, who first published it and how it reached you.

Public interest test

Weighing whether the value to the public of publishing information clearly outweighs any harm it could cause.

R

Reverse image search

Searching with an image instead of words to find where else it appears online and its earliest version.

S

Sanctions screening

Checking people and organizations against government sanctions lists before doing business with them.

SIGINT

Signals intelligence: intelligence from intercepted communications and electronic signals. It is a state activity, not part of OSINT.

Sock puppet

A fake online identity. Many platforms prohibit them, and using one to deceive people crosses ethical lines.

SOCMINT

Social media intelligence: analysis of publicly available social media content.

Source grading

Rating how reliable a source is and how credible a specific piece of information is, for example with the Admiralty Code.

Structured analytic techniques

Methods such as ACH and key assumptions checks that make an analyst’s reasoning explicit and reduce bias.

V

Verification

The process of confirming that information is authentic, accurate and correctly attributed before relying on it.

W

WTF Method

Marie-Soleil Seshat Landry’s investigative framework that turns an anomaly (“that’s odd”) into verified intelligence through 5W+1H questions and the Landry Loop.