OSINT METHODOLOGY & STRUCTURED WORKFLOW

OSINT without methodology is just enthusiastic googling. You can get lucky that way. You cannot get consistent, and you cannot hand the work to someone else without them weeping. Methodology is a question, a boundary, a record, and a stop.

Why this matters

Unstructured collection produces two failure modes: forty-seven tabs and no finding, or a tidy slide that cannot survive "how do you know?" Structure lets you reproduce results, defend conclusions, and reopen the file later without reconstructing your memory.

What you'll be able to do

You will state a one-sentence objective, pick sources and tools, set a time budget and stop condition, and place that plan inside the Intelligence Cycle and PEAK. The planning list stays. Expand it; do not replace it.

Methodology is the difference between a lucky find and a reliable result

Lucky finds still happen. Professionals write them down, check them, and refuse to build a case on a single coincidence. If you cannot describe what would make you *stop*, you do not have a task. You have an open tab with ambition.

What good methodology gives you

• **Repeatability**: Someone else can follow your steps and reach similar conclusions.
• **Coverage**: A checklist prevents forgetting whole categories of sources.
• **Defensibility**: Your notes show how you got from question to answer.
• **Efficiency**: You stop retracing steps because you recorded them the first time.

Those four are how you survive review, avoid forgotten source categories, keep a finding when a page changes, and still have time left to analyse.

Common methodology frameworks

Two models, one job: keep you honest about sequence.

The Intelligence Cycle (Traditional)

1. **Direction** - What question are we answering?
2. **Collection** - Gather raw data from appropriate sources.
3. **Processing** - Clean, translate, format, deduplicate.
4. **Analysis** - Turn data into judgements.
5. **Dissemination** - Deliver the product.

Direction is the step students skip because searching feels like work. If the question is "everything about this company," you have not directed anything. Tighten until a reasonable person could say you are done. The cycle is a loop: a report that creates a new question goes back to Direction.

The PEAK Model (Practical for SMBs)

1. **Prepare** - Scope, tools, legal boundaries.
2. **Explore** - Broad search, open questions, hypothesis generation.
3. **Analyze** - Filter, verify, connect dots.
4. **Know** - Report, recommend, close or continue.

PEAK is the Cycle in clothes you can wear on a two-hour task. Prepare is Direction plus rules of engagement. Explore is wide Collection. Analyze is Processing plus Analysis. Know is Dissemination plus an explicit close. Use PEAK for a short engagement and the Cycle when you must brief someone who learned the textbook names. Do not invent a third framework this week.

Your First Investigation Plan

Every investigation should start with five minutes of planning:

1. **One-sentence objective**: "I need to find the registered owner of example.com."
2. **Source list**: WHOIS, Wayback Machine, LinkedIn, Crunchbase.
3. **Tools needed**: Terminal, browser, screenshot tool.
4. **Time budget**: 2 hours. If it takes longer, reassess.
5. **Stop condition**: "When I have a name and address, I am done."

Expand the same five; do not swap them for a novel. The objective names the decision you are supporting. The source list is ordered. Tools are what you will actually run. The time budget includes notes. The stop condition is observable. Write legal boundaries in Prepare: public sources only, no pretexting. If the stop condition requires a private database or a lie, rewrite the objective.

Proper planning is how you avoid opening 47 tabs and realising 90 minutes later you forgot what you were looking for.

Numbered workflow

1. Write the one-sentence objective.
2. List sources and tools. Cut anything that does not serve the sentence.
3. Set time budget and stop condition.
4. Mark the PEAK stage you are in (you start in Prepare).
5. Execute Explore only after the plan exists on a page.
6. When the stop condition hits, move to Know — even if the answer is "not found."

Legal and ethical boundaries

Methodology includes saying no. Public information, stated purpose, proportionate collection. A plan that requires impersonation, credential stuffing, or "just this once" private access is not a clever PEAK variant. It is out of scope.

Common mistakes

Calling "look around" an objective. Listing twenty tools and using two. No stop condition. Skipping Prepare because the first search already felt promising. Reporting Explore output as if it were Analyze.

**Rule of thumb:** A stop condition is how adults end meetings. If your investigation cannot end, it is not thorough. It is unemployed.

Close with the exercise: write a one-page investigation plan for researching a company you choose. Include the objective, source list, tools, time budget, and stop condition — the same five, filled in like you intend to follow them.