After the course you can plan and carry out OSINT investigations in a structured way: you analyse domains, DNS data, company information, images and documents from open sources, check how credible they are and preserve the results so others can follow them. You also know the legal limits and where research has to stop. On top of that, you look at your own organisation through an attacker's eyes and derive countermeasures. The course suits people in security operations, threat intelligence, penetration testing, corporate security and compliance.
What you’ll take away.
- Plan an OSINT investigation with a clear question, legal boundaries and stopping criteria
- Analyse domains, DNS data, certificate transparency and publicly reachable services
- Assess images and documents using metadata, geolocation and reverse search
- Check sources for credibility and preserve and report results in a traceable way
- Assess your own organisation's public attack surface with the help of MITRE ATT&CK
Your training in detail
- Who is it for?
- Professionals in SOC, threat intelligence, penetration testing, corporate security, compliance and investigations who want to make targeted use of publicly available information.
- Prerequisites
- You are comfortable in a browser and on the command line and know networking basics such as DNS and IP addresses. No programming knowledge is needed.
- Format & planning
- Standard length: 5 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Research cycle, scoping, legal framework and GDPR limits, and a safe working environment
Using search engines precisely: operators, web archives and earlier versions of pages
Technical traces: Whois, DNS, subdomains, certificate transparency and internet scan services
Organisations and roles: company registers, job adverts, social networks and assessing data leaks
Images, video and documents: metadata, geolocation and checking for manipulation
Assessment, documentation and reporting: source criticism, evidence preservation and presentation
The defender's view: reconnaissance in MITRE ATT&CK and measures to shrink the attack surface
In a fictional case you investigate an invented company: you map its domains and services, analyse supplied images and documents, and summarise the findings with source ratings in a short report with recommendations.
Exams, licences & credentials
The course is vendor-neutral and has no exam. There is no vendor certification attached to it; where provided, you receive a certificate of attendance from the training provider.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
Is OSINT research legal?
Analysing public sources is generally permitted, but personal data falls under the GDPR. The course covers these limits and is not legal advice.
Do we work on real people or companies?
No. The exercises use fictional cases and supplied data so that no third parties are investigated.
Does Open Source Intelligence (OSINT): researching and assessing open sources methodically include a certificate?
The course is vendor-neutral and has no exam. There is no vendor certification attached to it; where provided, you receive a certificate of attendance from the training provider.