OSINT investigations
Case-based investigations into people, companies, online accounts and networks, from a single identity question to a multi-country inquiry.
Learn more →OSINT Services: Investigations, Due Diligence and Monitoring
OSINT services from OSINT-S turn publicly and commercially available information into answers you can act on: who a person really is, who controls a company, where the money went, and what is being said or planned about you online. Every finding comes with its source.
- Fixed quote before work starts
- Source-referenced reports
- Focused checks from 10 business days
- No hacking, pretexting or private-account access
What are OSINT services?
OSINT services are investigations and monitoring built on open-source intelligence: information anyone can lawfully see, buy or request, such as company registries, court records, the media, social networks and leaked-data markets. An OSINT services provider collects that information, verifies it against independent sources and turns it into a report that answers one specific question. At OSINT-S a focused check takes from 10 business days, a comprehensive review up to a month, and urgent work is possible.
Our OSINT Services
OSINT-S offers nine OSINT services. Together they cover most questions an organization asks of open sources, and each one starts with a written scope and ends with a source-referenced report.
Background checks
Identity, career, public-records and online-footprint checks on candidates, executives, partners and counterparties.
Learn more →Due diligence
Reputational, third-party and investor due diligence: ownership, sanctions, litigation and adverse media review.
Learn more →KYC and AML checks
Enhanced customer due diligence when your standard screening returns a hit, a gap or a complex ownership chain.
Learn more →Asset tracing
Tracing property, companies and holdings across jurisdictions to support litigation, enforcement and recovery.
Learn more →Company investigations
Who really owns and runs a company, who it trades with, and whether its claims hold up.
Learn more →Dark web monitoring
Leaked credentials, stolen data and mentions of your company, staff and assets on criminal forums, markets and channels.
Learn more →OSINT monitoring
Ongoing alerts on counterparties, portfolios, brands and events, triaged by an analyst before they reach you.
Learn more →Threat intelligence
Open-source cyber threat intelligence on the actors, campaigns, phishing and vulnerabilities aimed at your organization.
Learn more →These are the most requested. See all investigation, screening and intelligence services, including executive protection, fraud and crypto investigations, brand protection and training, or browse OSINT by industry.
What Are OSINT Services?
Professional open-source intelligence work done for a client: an analyst team collects, verifies and analyzes public and commercial information to answer a defined question, and delivers the answer with its evidence.
Open-source intelligence, or OSINT, is intelligence derived exclusively from publicly or commercially available information that addresses a specific requirement. That is the definition the US intelligence community uses (IC OSINT Strategy 2024–2026). OSINT services apply the same discipline to business questions: a hire, a deal, a dispute, a threat.
A search engine gives you claims. A professional OSINT team gives you findings. The difference is the work in between:
- Scoping: turning a worry into a question that open sources can answer, within a lawful and proportionate purpose.
- Collection: registries, court records, media archives, online footprint, imagery and specialist data, not just the first page of results.
- Verification: testing each material claim against records created independently of it.
- Analysis: connecting findings into ownership maps, networks and timelines, and saying how confident we are.
- Reporting: an answer you can act on, with sources, captures and open questions listed.
Some providers call the same thing OSINT solutions or OSINT as a service. Whatever the label, you are buying a verified answer rather than a tool.
What Questions Can OSINT Services Answer?
Questions that turn on facts somebody, somewhere, has recorded in public: identity, ownership, relationships, assets, reputation and intent.
- Is this person who they say they are? Identity, education and employment history, directorships, litigation and media coverage.
- Who is really behind this company? Beneficial owners, nominee structures, related companies and links to sanctioned or politically exposed persons.
- Where are the assets? Property, company holdings and vehicles recorded in registries across several countries.
- Who runs this account or website? Attribution of anonymous accounts, domains and channels behind fraud, impersonation or harassment.
- Has our data leaked? Employee credentials, customer records and internal documents offered on criminal forums and channels.
- Is anyone planning to harm us? Threats against staff, offices and events, phishing infrastructure and actors targeting your sector.
- What would a regulator, journalist or court find? The record a careful third party could build about you, your executives or a deal.
If the answer depends on information that is not lawfully accessible, such as private messages, bank records or phone metadata, OSINT is the wrong tool and we will say so at scoping.
Who Needs OSINT Services?
Teams that make decisions about people and counterparties they cannot fully see: security and risk, legal, investment, compliance, HR, insurance and public-interest organizations.
Corporate security and risk teams
Security teams use open sources to see threats before they arrive: impersonation of executives, leaked credentials, planned protests at a site, actors targeting the sector. Typical services: OSINT monitoring and threat intelligence. More on OSINT for corporate security teams.
Law firms and litigators
Before you sue or enforce, you need to know where the assets are, who the witnesses are and what the other side has said in public. Typical services: asset tracing and OSINT investigations. More on OSINT for law firms.
Investors, private equity and venture capital
Founders, co-investors and cap tables are rarely as simple as the pitch deck. Typical service: investor due diligence.
Banks, fintech and compliance teams
When automated screening returns a hit, a gap or an opaque ownership chain, an analyst resolves it with records from the countries involved. Typical service: KYC and AML checks. More on OSINT for banks, fintech and investors.
HR, executive search and boards
Senior hires and board appointments deserve more than a reference call. Typical service: background checks.
Insurers
Open sources often show whether a claim, a claimant or an incident is what it appears to be. Typical service: fraud investigations. More on OSINT for insurers and SIU teams.
NGOs, media and public bodies
Networks behind disinformation, sanctions evasion or supply-chain abuse are often visible in public records, and documenting them carefully is what makes the findings usable. Typical service: company investigations. More on OSINT for NGOs and newsrooms.
How an OSINT Engagement Works
Six steps, from a short brief to a debrief on the findings. You see a written scope and a fixed quote before any research starts.
- Brief and legality checkYou tell us the question and the decision it supports. We confirm the purpose is lawful and proportionate, and turn down requests that are not.
- Scope and fixed quoteWe agree the subjects, jurisdictions, depth, deadline and deliverables in writing, with a price that does not move unless the scope does.
- Team and collectionA team is formed around the task: analysts who know the jurisdictions involved, working with registries, court and media archives, online footprint and specialist data.
- VerificationEach material finding is checked against independent sources, and a senior analyst reviews the results before anything is reported.
- Report and debriefYou receive a source-referenced report that separates confirmed facts, open questions and material risks, with an analyst debrief on request.
- Optional monitoringIf the risk is ongoing, we keep watching the same subjects and alert you when something material changes.
What Does a Finished OSINT Report Include?
A report you can defend: every material statement is tied to a source, and confirmed facts are kept apart from what remains uncertain.
- Executive summary with the answer to your question and a clear risk view.
- Findings with sources: registry extracts, court references, media and online records, each with its link or reference and the date it was observed.
- Evidence pack: captures of the pages and records relied on, so the findings can be checked later even if the originals change.
- Maps where they help: ownership and control structures, relationship networks, timelines and asset maps.
- Open questions and next steps: what could not be confirmed from open sources, and what it would take to resolve it.
Reports are written in English. If the report may be used in proceedings, tell us at the brief so the evidence is collected and documented with that in mind.
Where We Work
Worldwide, scoped country by country, with regular work on UK, EU and US subjects and their counterparties abroad.
| Region | What we do there |
|---|---|
| United Kingdom | Due diligence, background checks, asset tracing and company investigations on UK subjects, built on Companies House filings, court records and UK media, and scoped under the UK GDPR. |
| United States | Investigations, due diligence and threat intelligence on US subjects and on foreign counterparties of US clients. For US employment decisions, we flag Fair Credit Reporting Act requirements at scoping. |
| European Union | Company, ownership and sanctions work across EU registries, scoped under the GDPR. |
| Elsewhere | Multi-country cases with offshore structures, scoped country by country. |
Which Sources Do We Use, and Which Lines Don't We Cross?
Lawfully accessible open sources and licensed data, including criminal forums and leak sites for cyber work, plus agreed local inquiries where they are lawful. No hacking, no pretexting, no access to private accounts.
Our analysts work with public and restricted registers worldwide, court and corporate records, media archives, social networks and online communities, satellite and street-level imagery, and specialist data on leaks and cybercrime. Where a case needs it and the law allows, we agree local verification or human-source inquiries with you in advance and keep them proportionate to the question.
What we will not do. We do not hack or log in to accounts, pose as someone else to obtain records, bypass privacy settings, buy unlawfully obtained data to identify individuals, or locate people without a lawful purpose. We do not work for representatives of authoritarian regimes.
Public information is still personal data. Under the EU and UK GDPR, investigations rely on a legitimate interest that has to pass a balancing test (EDPB Guidelines 1/2024), and data protection authorities have reminded businesses that publicly accessible personal information remains protected (joint statement, 2023). In the UK, obtaining personal data without the controller's consent can be an offense under section 170 of the Data Protection Act 2018; in the US, pretexting for financial records is banned under the Gramm-Leach-Bliley Act.
Typical OSINT Engagements
Four typical requests show the range: sanctions evidence, asset tracing, partner vetting and investor due diligence. They describe the kind of work we do, not named clients.
Evidence packs on a sanctioned network
A public body or NGO needs source-referenced profiles of the people and companies linked to a sanctions program, fast enough to feed a designation process. You receive one dossier per subject, with roles, ownership links and an evidence pack.
Tracing assets before enforcement
A law firm holding a judgment needs to know what the debtor owns, through which companies and in which countries. You receive an asset map with registry references and a confidence level for each link.
Vetting a strategic partner
Before signing, a company checks whether a partner's disclosures match the records: ownership, directorships, property, litigation and media. You receive the discrepancies, each with its source.
Due diligence on a startup's founders
A fund checks founders and co-investors before a round closes: undisclosed business interests, litigation and reputational red flags. You receive a risk summary the investment committee can act on.
How Much Do OSINT Services Cost?
Each request is priced after scoping, as a fixed quote. Urgent work carries a 50% surcharge. Public benchmarks run from about $75 an hour for a basic US private investigator to €7,500 a year for a professional OSINT platform license.
The price depends on the number of subjects and countries, how much ownership or network mapping is needed, how thin the records are, and the deadline. A focused check takes from 10 business days and a comprehensive review up to a month. If we cannot deliver on the agreed date, we tell you in advance and reduce the fee.
| Item | Figure | Source |
|---|---|---|
| US private investigator, basic work | $75–$125 an hour | Talo cost guide |
| UK OSINT contractor day rate (median) | £575 a day | ITJobsWatch |
| Due diligence report on one US subject | $550 (individual), $750 (business) | Global Backgrounds |
| Maltego Professional platform | €7,500 a year | Maltego pricing |
OSINT Services vs OSINT Tools vs an In-House Team
Tools give you data, an in-house team gives you control, and a service gives you a verified answer without hiring. Many buyers combine a tool for routine checks with a service for the decisions that matter.
| OSINT-S (service) | OSINT tools and platforms | In-house OSINT team | |
|---|---|---|---|
| Who does the work | Our analysts | Your staff | Your staff |
| Typical cost | Fixed fee per task | From £19 a month to six figures a year | Salaries (UK median £65,579 for OSINT roles, ITJobsWatch) plus tools and training |
| Verification | Built in, with a second check | Up to the user | Depends on the team |
| Jurisdictions covered | Assembled per task | Limited by the tool's coverage | Limited by who you hire |
| Best for | High-stakes, occasional or cross-border questions | High volumes of routine lookups | Constant, sensitive, in-house demand |
Popular OSINT tools and what they cost
| Tool | What it does | Published price |
|---|---|---|
| Maltego | Link analysis and graph investigations | €0 / €3,000 / €7,500 a year (Maltego) |
| OSINT Industries | Lookups on an email, phone number or username | £19–£99 a month (OSINT Industries) |
| Intelligence X | Search across leaks, archives and the dark web | €2,500–€20,000 a year (Intelligence X) |
| Shodan | Internet-connected devices and exposed services | $49 one-off; $69–$1,099 a month (Shodan) |
| Hunchly | Capturing web pages as evidence | €149 a year (Hunchly) |
Tools are only as good as the analyst using them. For a longer list, see our guide to OSINT tools.
How to Choose an OSINT Provider
Ask seven questions before you sign: who does the work, which sources they can reach, how they verify, what the report separates, what they refuse to do, who you contract with, and whether the price is fixed.
- Who will work on my case? Their experience should match the countries and sources involved.
- Which sources can you reach for this question, and which can you not? Honest limits are a good sign.
- How do you verify a finding? Look for independent corroboration and a second check before reporting.
- What will the report separate? Confirmed facts, assessments and open questions should never be mixed.
- What will you refuse to do? A provider that will hack, pretext or buy leaked data puts you at risk.
- Who is the legal entity, and where is it registered? You need a contract, confidentiality terms and data-protection terms.
- Is the price fixed, and what if you miss the deadline? A fixed quote against a written scope avoids surprises.
If you only need one person for a small task, read how to hire an OSINT investigator.
Why Choose OSINT-S?
A team assembled around each question, a fixed quote against a written scope, and reports that separate what is proven from what is not.
- Analysts, not just software. Every finding is collected, checked and written up by people who investigate for a living, with a second check before anything is reported.
- Cross-border by default. Ownership chains, assets and online accounts rarely stop at one border, so cases are scoped country by country from the start.
- Fixed scope, fixed price. You approve a written scope and a fixed quote before any research starts. If we miss the agreed date, the fee goes down.
- Monitoring with an analyst in the loop. Ongoing work combines automated collection with analyst review, so you get alerts that matter rather than raw feeds.
- Confidentiality. We never disclose sources or client data without written consent, and we can work under your NDA.
Want to know more about the team? Read about OSINT-S as an OSINT agency, or about OSINT consulting and training if you need advice rather than a report.
When We Are Not the Right Choice
If you need physical surveillance, process serving or a licensed private investigator in a particular US state, forensic imaging of devices, or information that only a court order can unlock, you need a different provider or legal process. We will tell you at the first call if one of these applies.
Tell Us the Question. We'll Scope It for Free.
Send a short brief: who or what, the decision it supports, and your deadline. An analyst replies with a scope, a timeline and a fixed quote.
OSINT Services FAQ
We're a mid-sized company that has never used outside investigators — what do OSINT services actually include, and how are they different from our own team just googling a new supplier?
OSINT services include scoped investigations and ongoing monitoring built on open-source intelligence, which the US intelligence community defines as intelligence derived exclusively from publicly or commercially available information (IC OSINT Strategy 2024–2026). The difference from googling is the work in between: an analyst turns your concern into an answerable question, collects from registries, court records, media archives and online sources a search engine does not surface, verifies each material claim against independent records and reports the answer with its sources and open questions. A search gives you claims; a provider gives you findings.
We already pay for a couple of OSINT tool subscriptions, so I'm trying to work out whether we still need outside OSINT services or whether my own analysts can handle everything in-house?
It depends on volume and stakes: tools suit high volumes of routine lookups, while OSINT services suit high-stakes, cross-border or occasional questions. OSINT tools are software your own staff use to search and analyze open sources, and they are only as good as the analyst using them. A service is work done for you: analysts choose the sources, verify the findings with a second check and deliver a report. Some providers call this OSINT as a service, meaning you buy the verified outcome rather than the tools and staff. Many buyers combine a tool for routine checks with a service for the decisions that matter.
Our legal team is nervous about the GDPR — if we commission OSINT services to look into a business partner, are we exposing ourselves to data-protection or privacy risk in the UK or EU?
Not if the purpose is legitimate and the methods are lawful, but public information is still personal data, so the work needs a lawful basis and a proportionate scope. Under the EU and UK GDPR, investigations usually rely on a legitimate interest that has to pass a balancing test. We confirm the purpose at the brief, keep the research proportionate to the question and turn down requests that are not lawful. Hacking, pretexting and access to private accounts are illegal in most countries, and we do not do them.
I need a rough budget before I go to procurement — how much do OSINT services cost for checking one company, and is there a public benchmark I can compare a quote against?
We price each request after scoping as a fixed quote that does not move unless the scope does, and urgent work carries a 50% surcharge. The price depends on the number of subjects and countries, how much ownership or network mapping is needed, how thin the records are and the deadline. For public benchmarks, basic US private investigator work costs about $75–$125 an hour, UK OSINT contractors earn a median of £575 a day, and one published due diligence report on a single US business costs $750.
We're signing a distribution deal at the end of the month and need the counterparty checked first — how long does an OSINT investigation usually take, and can you speed it up if needed?
A focused check takes from 10 business days, so a month is usually enough for one counterparty; a comprehensive review takes up to a month. Some smaller tasks take a single business day, and urgent delivery is available for an extra 50%. Your fixed quote gives a firm delivery date, and if we cannot deliver on it, we tell you in advance and reduce the fee. Put the signing date in your first email so the scope, depth and deadline are set around it.
I run risk at an insurance company and I'm not sure we're the typical client — what kinds of organizations actually use OSINT services, and for which decisions do they use them?
Any organization that makes decisions about people or counterparties it cannot fully see, insurers included. Corporate security teams use OSINT services for monitoring and threat intelligence, law firms for asset tracing before enforcement, investors for founder and co-investor due diligence, banks and fintech companies when screening returns a hit or an opaque ownership chain, HR and boards for senior hires, and NGOs, media and public bodies for network research. Insurers use open sources to see whether a claim, a claimant or an incident is what it appears to be.
We suspect some employee passwords ended up on a criminal forum after a vendor breach — do your OSINT services cover the dark web, and would you buy the data to confirm it?
Yes, the dark web is in scope, but we observe and document rather than buy. Criminal forums, markets, leak sites and messaging channels are open sources in the sense that anyone can observe them, and they matter for cyber and fraud work such as leaked employee credentials. We record what is offered, where and when, and report it with captures; we do not buy stolen data to identify people. See dark web monitoring.
Our company is based in London but most of our counterparties are in the US — do you provide OSINT services in both countries, and does US law add any rules we should know about?
Yes. We regularly work on UK, EU and US subjects and on foreign counterparties of UK and US clients, scoped country by country. UK work draws on Companies House filings, court records and UK media and is scoped under the UK GDPR. In the US, the main extra rule concerns use: a report that feeds an employment decision can fall under the Fair Credit Reporting Act, and we flag those requirements at scoping. Pretexting for financial records is also banned under the Gramm-Leach-Bliley Act.
A former tenant owes us money and has stopped answering — can OSINT find his current phone number or home address, and would you get into his private social media to find it?
Sometimes, because such details appear in registries, listings or old records, and tracing a debtor is a lawful purpose. We only look for contact or location details when there is one, and we do not help anyone locate a person to harass or harm them. We also do not log in to other people's accounts, use fake profiles to gain access to private content or bypass privacy settings; what is private stays out of scope. If the answer only sits in private data, legal process is the next step.
We may end up in arbitration with a supplier and I don't want them to learn we're looking — can an OSINT report be used as evidence, and will our request stay confidential?
Open-source findings are used in litigation and arbitration, but admissibility depends on the forum and on how the evidence was collected and documented. If your report may be used in proceedings, tell us at the brief so we preserve and document the evidence accordingly, with captures and dates, and involve your lawyers early. Your request stays confidential: briefs are read by an analyst and used only to scope the work, we do not disclose client information or our sources without written consent, and we can work under your NDA.
Sources and Notes
- ODNI: IC OSINT Strategy 2024–2026
- EDPB Guidelines 1/2024 on legitimate interest
- Joint statement on data scraping (ICO and other authorities, 2023)
- UK Data Protection Act 2018, section 170
- 15 U.S.C. §6821 (GLBA pretexting)
- Talo: private investigator cost guide
- ITJobsWatch: OSINT contract and permanent rates (UK)
- Global Backgrounds: due diligence report prices
- Maltego: pricing
- OSINT Industries: pricing
- Intelligence X: products
- Shodan: plans
- Hunchly: pricing
Sources checked 6 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.
Related pages
Practical research guides
Explore the methods, verification steps and evidence questions behind a well-scoped investigation.
- How to Conduct an OSINT Investigation: A Practical Research Guide
- Company Due Diligence Checklist: How to Verify a Business Before a Deal
- How to Research Beneficial Ownership and Map Company Connections
- Social Media Investigation Guide: Verify Accounts, Posts and Digital Evidence
- Asset Tracing Guide: How to Research Holdings and Verify Ownership Links