Building an OSINT Capability for Corporate Security

Building a mature OSINT capability means providing your organisation with a repeatable way to identify intelligence requirements, select appropriate sources, collect and verify information, assess its significance and communicate findings to decision-makers. 

Building this capability does not necessarily require a large team or budget. At its most basic, it requires a clear understanding of what the organisation needs, who is responsible for delivering it and how OSINT will support wider security decisions.

Start With the Decisions OSINT Needs to Support

The first question should be what decisions the security team needs to make. Corporate security teams may need intelligence to support decisions about:

• Executive protection
• Employee and workplace safety
• Travel and event security
• Office, store and warehouse security
• Insider-risk investigations
• Fraud and loss prevention
• Organised retail crime
• Brand and intellectual property protection
• Supply-chain disruption
• Crisis management
• Business continuity
• Escalation to law enforcement

These broad responsibilities must then be translated into more specific intelligence requirements.

For example:

• Are there credible threats against an executive attending an event?
• Are stolen products being offered for sale online?
• Is a former employee publishing confidential company information?
• Does an employee have an undeclared connection to a supplier?

A requirement should identify the question, the customer and the decision it is intended to support. Without this, analysts can spend considerable time collecting information that is interesting but not operationally useful.

Identify the Intelligence Customer

Every OSINT product should have an intended customer.

That customer might be from the C-suite, a loss-prevention manager, investigator, or law enforcement. These different customers require different levels of detail.

Someone responsible for executive protection may need an immediate alert about a person approaching a venue. A senior leadership team may need a concise assessment of how industrial action could affect operations over the next week. Legal counsel may require a detailed record of how online evidence was collected and verified.

Understanding the customer helps determine what should be collected, how quickly it is needed and which intelligence product should be produced.