July 10, 202611 min read

Reducing Your Corporate OSINT Attack Surface: What Attackers Find Before They Attack

Sources:SANS OSINT Recon Techniques: What Attackers See|SpiderFoot OSINT Framework|Google Project Zero: Reconnaissance Phase Attack Research

Eric Bang

Founder & Cybersecurity Evangelist

60%

of targeted attack chains begin with passive OSINT reconnaissance — no scanning, no exploitation, just public information aggregation

87%

of penetration testers say LinkedIn is their most valuable free reconnaissance source for targeted engagements

Average 17 days

that attackers spend in passive reconnaissance before active exploitation in advanced persistent threat engagements — FireEye/Mandiant research

37%

of organizations have employees with detailed technology stack information in their LinkedIn skills — directly telling attackers what to exploit

Reach 50,000+ security professionals

Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.

info@decryptiondigest.com View Sponsorship Options

Summarize with:

ChatGPT

Claude

Google AI

OSINT (open source intelligence) reconnaissance is the first phase of most targeted attacks. Before an attacker attempts a single phishing email or scan, they have built a profile of your organization from public sources: who works there, what technology they use, what vulnerabilities your tech stack is known to have, what your network ranges and cloud provider are, and what your current security gaps might be.

Reducing your OSINT attack surface does not mean hiding your organization from the internet — it means being deliberate about what information you make easily available and what information you require an attacker to work harder to obtain. Information that requires effort to gather reduces attacker efficiency and narrows the pool of attackers who will invest that effort against you.

LinkedIn: the attacker's free intelligence database

LinkedIn is the highest-value free OSINT source for attackers targeting corporate networks. Employee profiles reveal technology stacks, organizational structure, and decision-maker contact information.

Skills and technology stack exposure

LinkedIn's skills endorsement feature creates a near-complete inventory of your technology stack as documented by employees. If 15 employees list 'Palo Alto Networks' in their skills, an attacker knows your firewall platform and can focus on known Palo Alto vulnerabilities and default configurations. If employees list 'Okta SAML', 'Azure AD', 'Splunk', and 'CrowdStrike Falcon', the attacker has your entire security tool stack in five searches. This information directly informs which exploits, misconfigurations, and social engineering scripts are most likely to succeed against your organization.

What to do about LinkedIn technology exposure

You cannot prevent employees from listing skills — attempting to do so creates morale issues and is largely unenforceable. What you can do: (1) Publish a technology disclosure policy: employees should not list specific security tool names in public profiles (listing 'Information Security' as a skill is fine; listing 'Qualys Vulnerability Scanner and Tenable.io' is not). (2) Conduct an annual LinkedIn audit of employee profiles for technology disclosure risk. (3) Recognize that this information leakage is background noise you manage, not eliminate — focus defensive effort on the controls an attacker would target after gathering this information.

Organizational structure and decision-maker mapping

LinkedIn makes it trivial for an attacker to identify: the CISO and their reporting structure, IT administrators with domain admin in their title, finance managers who approve wire transfers (BEC targets), and executive assistants who have access to executive accounts. This information enables targeted phishing (spear phishing to the CISO), BEC fraud targeting finance, and helpdesk social engineering using accurate organizational knowledge. Assess what executive and sensitive-role employees' LinkedIn profiles reveal about access and organizational position.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Job postings as a security intelligence source

Job postings are required for hiring but often include more security-relevant detail than necessary. An attacker who reads your current job postings can identify security gaps, technology migrations, and team weaknesses.

What specific technology requirements reveal

A job posting for a 'Senior Security Engineer with 5+ years of Splunk ES experience, familiarity with Sentinel a plus' tells attackers: your primary SIEM is Splunk Enterprise Security, you are potentially migrating to or experimenting with Microsoft Sentinel, and your team may have a gap in Sentinel-specific expertise. A posting for a 'CISO' or 'VP of Information Security' suggests the position is open — meaning your security leadership is in transition, a period of reduced strategic oversight.

Audit your job postings for unnecessary security detail

Review current and recent job postings for: specific security vendor names that are not necessary for candidates to know, descriptions of security program gaps ('building our incident response capability' tells attackers you do not have one), and technology implementation details ('migrating from on-premises to cloud' tells attackers you are in a vulnerable transition state). Remove specifics that are not essential for candidate qualification — 'experience with enterprise SIEM platforms' conveys the same requirement without naming the specific platform.

Stagger high-profile security leadership postings

Posting for CISO, Head of Security, or Director of IT Security simultaneously with other security team postings signals significant security team disruption. Consider posting senior roles through headhunters rather than public job boards for the first several weeks, and limit the detail provided in public postings for leadership security roles.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

GitHub and code repositories

GitHub organization accounts, public repositories, and commit history are significant OSINT sources for technical attackers. Internal tooling, infrastructure patterns, and occasionally credentials appear in public code.

GitHub organization audit

Run a quarterly audit of your GitHub organization: what repositories are public vs. private, what contributor accounts have access, and whether any public repositories contain internal infrastructure details, internal domain names, IP ranges, or other reconnaissance-valuable information. Tools: GitHub's organization security tab, or open source GitHub scanning tools like Gitleaks run against your organization's public repositories.

Former employee repository access

Former employees who were contributors to organizational repositories sometimes retain read access to private repositories after departure if their GitHub account was not removed from the organization. Audit organization membership against current employee roster. Remove former employees from the organization promptly at departure — GitHub access does not automatically sync with your corporate IdP unless you have configured GitHub Enterprise with SCIM provisioning.

Internal domain and infrastructure patterns in public code

Infrastructure-as-code files, CI/CD configurations, and internal tooling that gets accidentally made public often contains internal domain names (prod.internal.company.com), private IP ranges, and cloud resource naming conventions that help attackers map your internal infrastructure. Even when credentials are not present, this structural information provides reconnaissance value. Configure GitHub secret scanning and also DLP-style scanning for internal hostname patterns in public repository pushes.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

DNS, certificate transparency, and passive network reconnaissance

Passive network reconnaissance — using public DNS records, certificate transparency logs, and WHOIS data — reveals cloud infrastructure, subdomains, and technology providers without any active scanning against your systems.

Certificate transparency log enumeration

Every TLS certificate issued for your domains is logged in public certificate transparency (CT) logs. Attackers enumerate CT logs (using tools like crt.sh, Censys, or Shodan) to discover all subdomains of your organization — including staging environments, internal tools exposed via reverse proxy, development environments, and legacy systems that may have outdated security controls. Run this enumeration against your own organization: crt.sh/example.com returns all certificates ever issued for your domain. Review the list for unexpected subdomains or forgotten exposed services.

DNS reconnaissance and shadow IT discovery

DNS enumeration tools (amass, subfinder) discover subdomains through DNS brute force, certificate transparency, and public source aggregation. The result often reveals SaaS applications that have been connected to your domain via DNS records: internal tools exposed via DNS alias, cloud services with company-domain verification records, and staging environments accessible from the internet. This enumeration reveals your shadow IT footprint — services IT may not know are publicly reachable.

Shodan and Censys for your internet-facing infrastructure

Run a Shodan or Censys search for your organization's IP ranges and primary domain. The results show what services and software versions your internet-facing infrastructure is advertising to the world. Unexpected open ports, outdated software versions, and misconfigured services discovered here by an attacker before you find them represent your external exposure. This should be part of your quarterly external attack surface review — know what an attacker with passive reconnaissance capability sees before they do.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

OSINT reconnaissance reduction is not about making your organization invisible — it is about removing the easily-gathered information that gives attackers a significant advantage in the targeting and initial access phases of an attack. A quarterly internal OSINT assessment using the same tools attackers use (LinkedIn search, job posting review, crt.sh, Shodan, GitHub enumeration) takes 2 to 4 hours and surfaces specific exposures you can reduce. The information you do not give attackers for free is information they must invest time and effort to gather, raising the cost of targeting your organization relative to the organizations that are not doing this work.

Frequently asked questions

Can we prevent employees from listing our technology stack on LinkedIn?

You can establish a policy asking employees not to list specific security product names in public profiles, but enforcement is difficult. Focus the policy on the highest-risk disclosures (specific security monitoring tools, authentication systems) and frame it as a privacy protection for the employee as well as the organization. Separately, recognize that the attacker's primary use of LinkedIn technology stack information is to know which exploit paths to pursue — the defensive answer is ensuring your tools are properly configured and patched, not preventing the disclosure of which tools you use.

What is certificate transparency and why does it reveal my subdomains?

Certificate transparency is a public logging requirement for TLS certificates — every certificate issued by a publicly trusted CA must be logged in a public CT log (Google, Cloudflare, and others operate these logs). This was designed for detecting unauthorized certificates. The side effect is that every subdomain of your organization for which you have ever obtained a TLS certificate is publicly logged. Attackers enumerate these logs to discover subdomains — including internal tools, staging environments, and development systems that you may not have intended to be easily discoverable. This information cannot be removed from CT logs once logged.

Should we hide our technology stack from attackers?

Security through obscurity — hiding your technology to prevent exploitation — is generally not recommended as a primary defense because determined attackers discover technology through fingerprinting, job postings, and other sources. The value of reducing OSINT exposure is in raising the effort required for reconnaissance, not in achieving full information hiding. Use obscurity as one layer among many, not as a primary control. The primary defense against attackers who know your technology stack is keeping that technology properly patched and configured so knowledge of the platform does not translate into a viable attack path.

Sources & references

SANS OSINT Recon Techniques: What Attackers See
SpiderFoot OSINT Framework
Google Project Zero: Reconnaissance Phase Attack Research

Summarize with:

ChatGPT

Claude

Google AI

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Follow Decryption Digest

Daily briefings + Google Top Stories in one step.

Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

OSINT attack surface reduction corporate OSINT defense LinkedIn security exposure job posting security risk GitHub OSINT exposure digital footprint corporate OSINT reconnaissance defense 2026 reduce attacker reconnaissance