The case for OSINT as a defensive discipline — and an honest accounting of where it falls short

The uncomfortable finding buried in this year's breach data

Verizon's 2026 Data Breach Investigations Report contained a genuine surprise. For the first time in the report's nineteen-year history, vulnerability exploitation displaced credential abuse as the single most common initial access vector, accounting for 31% of breaches — up from roughly 20% the year before. Credential abuse fell to 13%.

That headline has been read in much of the coverage as evidence that identity attacks are receding. It isn't. Verizon separated pretexting into its own category this year, which absorbed part of credential abuse's share; measured by the prior methodology, credential abuse would have landed closer to 16%. And when Verizon counts credential abuse anywhere in the breach progression rather than only at the front door, it appears in 39% of breaches — still more than any other vector.

The more useful reading is this: both mechanisms now driving breaches at scale are visible from outside the target organization before anyone touches it.

An unpatched internet-facing appliance is discoverable by anyone running an internet-wide scan. A credential sitting in an infostealer log is discoverable by anyone with a marketplace subscription. Neither requires access. Neither generates a log entry on the victim's side. Both are, in the strict sense of the term, open source.

That is the argument for OSINT as a defensive discipline in 2026, and it is a narrower and more defensible argument than the one the category usually makes for itself.

What OSINT actually is, briefly

Open-source intelligence is intelligence derived from publicly available sources rather than covert collection. In practice, that means DNS and certificate transparency records, internet-wide scan data, public code repositories, job postings, professional networks, corporate filings, breach compilations, criminal forums, and extortion leak sites.

The distinction that matters is between searching and intelligence work. Running a Google dork is searching. OSINT is a process that includes collection requirements, source validation, structured analysis, and a stated confidence level for each conclusion. The tooling has become commoditized; the discipline has not.

It is also symmetric. Every source listed above is available to both sides. That symmetry is the whole point — and it cuts against the defender, because attackers are systematically better at using it.

Four exposure classes worth monitoring, with the evidence

1. Infrastructure you don't know you own

Intruder's 2026 Attack Surface Management Index found that 60% of the organizations it assessed had an HTTP administrative panel exposed to the internet, more than a quarter had a publicly reachable MySQL database, and 11% had Remote Desktop exposed. None of those requires a vulnerability to become a problem. Earlier in the year, hundreds of FortiGate firewalls were compromised without a zero-day; weak passwords on internet-facing administrative interfaces were sufficient.

The mechanism producing this is structural rather than negligent. Cloud infrastructure-as-code and auto-scaling let teams create resources faster than any inventory process tracks them. Mergers transfer entire unmapped estates in a single transaction. Contractors stand up staging environments that outlive the contract. Certificate transparency logs will show you subdomains your CMDB has never heard of, because the certificate had to be issued publicly for TLS to work at all.

Editorial caveat:  Several EASM vendors circulate a figure that organizations have visibility into roughly 60–65% of their external attack surface. We have not found a primary methodology behind that number and treat it as a vendor estimate rather than a measurement. The Intruder figures above are from a stated dataset and are more defensible.

2. Credentials that are already in circulation

GitGuardian's fifth State of Secrets Sprawl report, published March 2026, found 28.65 million new hardcoded secrets added to public GitHub commits during 2025 — a 34% year-over-year rise and the largest single-year increase the firm has recorded. Since 2021, leaked secrets have grown by 152%, while the active developer population has grown by 98%; secrets are proliferating roughly 1.6× faster than the people producing them.

Three findings from that report deserve more attention than the headline number:

• Remediation, not detection, is the failure point. 64% of secrets that GitGuardian validated as live in 2022 were still unrevoked in January 2026. The industry has built excellent detection, but has not built a repeatable revocation path.
• Internal repositories are roughly six times more likely to contain hardcoded secrets than public ones, and about 28% of incidents originate outside source code entirely — in collaboration and productivity tools.
• AI-assisted commits leaked secrets at roughly double the platform baseline, and secrets tied to AI services rose 81% to over 1.27 million. GitGuardian also identified 24,008 unique secrets in MCP configuration files, a leak category that did not meaningfully exist eighteen months ago.

On the criminal-market side, the numbers require more care. DeepStrike's stealer-log study put 2025 infostealer theft at 1.8 billion credentials across 5.8 million devices. KELA reported roughly 4 million unique infected devices in 2025, resulting in 347.5 million compromised credentials, rising to 2.86 billion records when existing log databases were included. These are not the same measurement, and the gap between them is instructive.

The June 2026 discovery of a 24-billion-record credential database on an open Elasticsearch cluster illustrates the problem precisely: analysis indicated roughly 22.6 billion of those records came from previously circulated "collections" — recompiled aggregations, not fresh theft. Malwarebytes researchers noted that the dataset appeared weighted toward fresh stealer logs rather than static breach data, which matters because fresh logs contain session tokens that may still be valid for authentication.

Anyone selling you a headline credential-exposure number without distinguishing fresh logs from recompiled aggregations is selling you a marketing figure. The operationally relevant question is not how many records exist. It is whether your domain appears in a log dated recently enough that the session cookies still work.

3. The organizational graph

CISA's joint advisory on Scattered Spider (AA23-320A), most recently updated in July 2025 with FBI investigative findings through June of that year, describes a group whose distinguishing capability is not exploitation. It is research.

The playbook: enumerate staff, titles, and reporting lines; identify the outsourced IT help desk; impersonate a specific named employee to that help desk convincingly enough to obtain an MFA reset; use push bombing and SIM swaps where impersonation alone falls short; then operate with valid credentials and legitimate administrative tooling. The advisory notes that the group maintains fake social media profiles to backstop newly created identities. More recent activity has included the deployment of DragonForce ransomware against VMware ESXi infrastructure.

All inputs to the reconnaissance phase are public. Job postings disclose the identity provider and security stack. Professional networks supply the org chart. Support-page metadata reveals which help desk is outsourced to whom. The countermeasure is not to delete your LinkedIn presence — that isn't an option for a company that needs to hire. It is to know precisely what the reconnaissance picture looks like, and to build identity-verification procedures that hold up against someone who already knows your CFO's direct reports, travel schedule, and email format.

Attribution note: "Scattered Spider" is an umbrella label applied across several tracked clusters (UNC3944, Octo Tempest, Muddled Libra, Storm-0875, among others). The May 2025 UK retail incidents were widely attributed to the group in press coverage; ReliaQuest's own write-up noted at the time that nothing definitive tied those specific breaches to it. We distinguish confirmed attribution from press consensus throughout.

4. Your vendors, before they tell you

Extortion groups publish victim listings on leak sites days or weeks before formal breach notification reaches downstream customers. For an organization with a mapped vendor estate, monitoring those listings is a low-cost early-warning channel that fires ahead of the disclosure email.

This is where OSINT stops being a security team hobby and starts being a third-party risk control. The workflow is unglamorous: maintain a current list of vendors with access to your data or environment, cross-reference it against victim disclosures, and treat a match as a trigger for credential rotation and access review rather than as news to file.

Caveat: leak-site claims are attacker assertions. Victim listings are sometimes fabricated, sometimes recycled from earlier incidents, and sometimes describe data obtained from a third party rather than the named organization. Treat a listing as a reason to investigate, never as a confirmed breach.

Where OSINT is oversold

An honest case for a discipline includes its failure modes. OSINT has several.

Volume is not intelligence. The dominant operational failure is drowning analysts in unprioritized findings. A monitoring program that generates 400 alerts a week and no decisions is worse than no program, because it consumes the budget that a working one would have needed.

Sources are unverified by construction. Open sources can be stale, incomplete, deliberately manipulated, or all three. Criminal forums contain a substantial volume of fraud aimed at other criminals. Verification against a second independent source is not optional rigor; it is the minimum standard before anything gets escalated.

Confirmation bias is the resident occupational hazard. Analysts find what they expect to find. Structured analytic techniques — documenting alternative explanations, deliberately seeking disconfirming evidence, and second-analyst review of consequential findings — exist because failure is predictable and correction is procedural.

Visibility is not exploitability. OSINT tells you an asset is exposed. It does not tell you the asset is vulnerable, that the vulnerability is reachable, or that reaching it gets an attacker anything. Without a validation step, an OSINT program produces a prioritized list that isn't actually prioritized.

The legal boundary is real and jurisdictional. Data being publicly accessible does not make it lawfully processable. GDPR and comparable regimes constrain what you may collect, retain, and act upon regarding identifiable individuals — including your own employees. Any program that touches personal data requires counsel involvement before it requires tooling.

And AI has not changed this as much as advertised. The 2026 DBIR's AI analysis, conducted in collaboration with Anthropic across 793 threat actors subject to enforcement action between March 2025 and February 2026, is notably unsensational: in the median case, actors sought assistance across about 15 distinct ATT&CK techniques, 44% of AI-assisted initial access activity was phishing-related, and under 2.5% of observed techniques were classified as rare. Meanwhile, phishing's share as an initial access vector barely moved year over year. The reasonable inference is that AI is raising the floor for less-capable attackers rather than unlocking novel techniques. It is an efficiency multiplier for reconnaissance and lure quality, which is a real problem and a different one from the one most vendor marketing describes.

What a defensible program looks like

Vendor-neutral, in rough order of return on effort:

1. Run reconnaissance against yourself on a schedule. Internet-wide scan data, certificate transparency, DNS enumeration, and public repository search. Quarterly is a floor; continuous is better for organizations with active cloud deployment.
2. Map every discovered asset to a named owner. An unattributed finding is an unactioned finding. This step is where most programs stall, and it is administrative rather than technical.
3. Monitor credential exposure continuously — and fix the revocation path first. Given that 64% of secrets validated in 2022 remained live four years later, detection capacity is not your constraint. Build the rotation workflow before you buy the monitoring feed, or you will simply end up with a longer list of things you haven't revoked.
4. Extend monitoring to non-code surfaces. Roughly 28% of secret exposures originate in collaboration tools. Scanning only repositories leaves a quarter of the problem unaddressed.
5. Maintain a vendor watchlist against extortion leak sites. Cheap, high-signal, and it fires before notification.
6. Harden identity verification at the help desk specifically. The reconnaissance is public and cannot be withdrawn; the verification procedure is yours and can be changed. Assume the caller knows the org chart.
7. Document the legal basis, retention limits, and escalation path before collection begins. Retrofitting compliance onto a running intelligence program is considerably more expensive than designing it in.

The asymmetry, restated

The gap between attacker and defender here is not one of capability. Both parties can read certificate transparency logs. It is wo rth noting that  attackers routinely examine an external picture of your organization that you have never looked at.

Closing that gap does not require exotic tooling. It requires deciding that the outside-in view is somebody's job, giving that person a remediation path that actually terminates in a fix, and accepting that the resulting findings will be uncomfortable — because the whole premise is that the exposure was already there, already public, and already indexed.

Why Organizations Choose Zaxtron

Organizations face increasingly sophisticated ransomware campaigns that exploit unpatched systems, stolen credentials, exposed remote access, and third-party weaknesses. To stay protected, they need actionable intelligence, not just alerts, to identify and reduce cyber risks before disruption occurs. Zaxtron provides Cybersecurity Risk Management, AI Risk Management, and Cyber Threat Intelligence services that deliver continuous visibility and risk-based insights. By combining attack surface intelligence, vulnerability data, threat and breach intelligence, and third-party risk analysis, Zaxtron offers a complete view of cyber exposure. This helps security leaders respond to threats, improve vendor security, and make informed decisions. Contact Zaxtron to strengthen cyber resilience today.