Safety Center

Learn OSINT From Scratch: A Beginner Roadmap

OSINT — open-source intelligence — means answering questions using only information that is already public. This roadmap takes you from zero to your first verified investigation, in order, using free tools and public sources only.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What OSINT is — and the boundary that defines it

OSINT stands for open-source intelligence: the collection and analysis of information from sources that are publicly available. That includes search engines, social media, news archives, maps and satellite imagery, public company registries, court records, academic publications, and public datasets. Intelligence analysts, journalists, researchers and investigators use OSINT every day to answer questions, verify claims, and build pictures of people, companies and events — all from material anyone could, in principle, find.

The boundary is the discipline. OSINT uses only publicly available information. It never involves bypassing logins, passwords or access controls, never involves unauthorised access to a system, and never involves obtaining non-public data. Two formulations from practitioner guides capture it exactly: 'publicly available only — never bypass logins, passwords, or access controls', and 'OSINT is not hacking. It does not involve unauthorized access.' If you have to defeat a control to see something, it is not OSINT, and doing it can be unlawful. Last checked: 14 November 2026.

The OSINT cycle: how investigations actually work

Professional OSINT follows a cycle, and learning the cycle matters more than learning any tool. First, define the question precisely: not 'find out about this company' but 'is this company registered, where, and who are its directors according to public filings?' Second, plan: which source types could answer it, and what would count as evidence? Third, collect: gather from public sources, saving the source, the date and the exact wording of what you found. Fourth, process and analyse: sort, compare, look for corroboration and contradiction. Fifth, report: write the answer with every claim sourced, and state what you could not verify.

Beginners usually skip straight to collecting, and then drown in tabs. The cycle prevents that: a precise question tells you when to stop, and a written report forces you to check whether each claim is actually supported. Throughout this guide, every exercise follows the cycle.

Stage 1 — Search like an investigator (weeks 1–2)

Advanced search operators are the first skill. Learn to search exact phrases in quotes, to exclude terms, to restrict results to a site or a file type, and to search by date. Practise on public topics: find the original announcement of a company merger, the earliest reporting of an event, or a public figure's own words on a specific date. The exercise that matters: take a claim you saw on social media, find its original source with operators, and write down whether the original supports the claim. Most of the time, you will find the claim is distorted — which is the first OSINT lesson.

Stage 2 — Verify everything (weeks 3–5)

Verification is the skill that separates investigators from collectors. The core rule is the two-source rule: a claim is not verified until two independent sources support it — and two sources that both copy the same original are one source, not two. Learn the 'four Ds' of media verification used by practitioner guides: distortion (a real thing presented misleadingly), disinformation (deliberately false), decontextualisation (real material from a different time or place), and deepfakes (synthetic media). For each, the check is different: distortion needs the original context, disinformation needs an authoritative source, decontextualisation needs a date and location check, and suspected synthetic media needs provenance and reverse search.

Verification exercise 1 — the photo. Take a widely shared photo of a public event. Reverse-image search it, find the earliest publication, check the date and location metadata claims, and decide whether the photo shows what the post claims it shows. Write a three-sentence verdict with sources. Exercise 2 — the company. Pick a small public company. Confirm its registration, its directors and its address from the public company registry — not from its own website alone. Note every place the two disagree.

Stage 3 — People, companies and places (weeks 6–10)

Now add structured source types, one at a time. For people (public figures only, in exercises): public social-media profiles, interviews, publications, and public records. For companies: company registries, filings, domain registration records, and job adverts, which reveal structure and technology. For places: maps, satellite imagery, street-level imagery, and public planning records. The rule for each type: record the source, the date accessed, and the exact claim it supports. An investigation that cannot show its sources is not an investigation; it is a story.

Use free tools by identifier type: search engines and social search for names and usernames; reverse image search for photos; map tools for locations; public registries for companies. Do not pay for tools at this stage. Free tools cover everything a beginner needs, and learning to work with limits is itself a skill.

Stage 4 — Your first full investigation (weeks 10–14)

Choose a public topic — a public company's claims, a local planning decision, or a viral claim about a public event — and run the full cycle: precise question, plan, collection, analysis, written report. The report should be one to two pages: the question, the answer in one paragraph, the evidence claim by claim with sources and dates, and a section headed 'What I could not verify' listing every gap honestly. That last section is what makes the report trustworthy, and it is the section beginners most often skip.

Share the report with a peer or mentor for a verification check: can they follow each claim to its source? If not, the sourcing is not good enough. This peer review is the closest a beginner gets to professional quality control, and it is where most improvement happens.

Ethics, privacy and staying safe

Respect platform terms and privacy law. Collecting public information for research, journalism or threat analysis is a legitimate purpose in most frameworks, but scraping at scale, circumventing controls, or republishing personal data can cross legal and ethical lines. When in doubt, collect less, document your purpose, and seek advice before publishing anything about a private person.

From beginner to practitioner

After the first full investigation, the routes open up: threat-intelligence work (where OSINT supports SOC and incident work — see MITRE ATT&CK and what a CVE is), journalism and fact-checking, due diligence, or corporate investigations. Each values the same core: a precise question, two independent sources, honest gaps, and a written report. Keep building the portfolio — three verified investigations, properly sourced, will open more doors than any single course certificate.

Tools by stage, without the shopping list

At Stage 1, you need a search engine and a notebook. At Stage 2, add reverse image search and a way to save pages with dates — screenshots of the page as you found it, plus the URL and the access date, are the minimum record. At Stage 3, add the public registries and map tools relevant to your investigation, and a spreadsheet for structured findings. At Stage 4, add a simple report template so every investigation ends in a written, sourced document. That is the whole toolkit for a beginner. Paid tools, link-analysis software and automation come later, if your work requires them — and most beginner work does not.

A note on what not to use: tools that claim to find private data, tools that bypass logins or access controls, and services that sell personal information. Those are not OSINT tools, and using them can cross legal and ethical lines. If a tool's marketing promises data you know is not public, do not use it, and do not recommend it.

Practice cases you can run this week

1. The viral claim. Find a widely shared claim on social media. Trace it to its original source, check the date and context, and write a three-sentence verdict: true, misleading, or false, with sources.
2. The public company. Pick a small listed company. Confirm its registration, its directors and its address from the public registry, then compare with what the company's own site says, and note the differences.
3. The old photo. Take a photo that is circulating as current news. Reverse-image search it, find its earliest publication, and decide whether it shows what the post claims.
4. The local decision. Find a planning or licensing decision in your area from public records, and write a one-page summary of what was decided, by whom, and on what evidence — all sourced.

Do one case a week for a month, file the reports in your portfolio, and you will have four verified investigations — more than most beginners can show, and a genuine basis for the next step, whether that is threat intelligence, journalism, or further study. The portfolio rules, including what must never go in it, are in our portfolio guide.

Sources

• Intelligence Notes — OSINT cycle and verification method (2-source rule, 4 Ds)
• PickAClass — Learn OSINT From Scratch (public sources only)
• Black Unicorn OSINT guide — tool reference by identifier type, OPSEC and legal notes
• Research methodology — how this guide was researched

Last checked: 14 November 2026

Frequently asked questions

What is OSINT?

OSINT is intelligence gathered from publicly available sources: public records, social media posts, news, maps, company filings, academic papers and anything else published openly. It does not involve unauthorised access, bypassing logins, or hacking.

Is OSINT legal?

Collecting and analysing information that is already public is legal in most countries, but the boundary matters: never bypass logins, passwords or access controls, never access non-public data, and respect privacy law and platform terms. Public does not always mean free to use however you like.

How long does it take to learn OSINT from scratch?

Expect several months of steady practice to become competent at structured investigations. The roadmap below is sequenced so each stage builds on the last; rushing to advanced tools before learning verification is the most common beginner mistake.

What free tools do OSINT beginners need?

A search engine with advanced operators, reverse image search, map tools, public record and company registry sites, and a notebook for structured notes. Tools matter less than method: a good investigator with a search engine beats a poor one with twenty tools.

What is the difference between OSINT and hacking?

OSINT uses only publicly available information and never involves unauthorised access. Hacking involves accessing systems without permission. The distinction is the whole discipline: if you have to bypass a control to see it, it is not OSINT.

Can OSINT lead to a career?

Yes — in threat intelligence, journalism, due diligence, law enforcement support, and corporate investigations. The route usually runs through a portfolio of careful, sourced investigations and, for many, prior SOC or analyst experience.