OSINT Investigation Services: Evidence You Can Defend, Not Just Find

Every OSINT engagement is sold with the same promise: answers drawn from public sources, delivered in a report. The promise is true and nearly meaningless, because the value of an open-source investigation is not in what it found. It is in whether a second analyst, a regulator, a court or the subject's own lawyer could reproduce the finding from the report alone - and whether the confidence attached to each line is calibrated to the evidence behind it rather than to the analyst's mood.

That is the difference between a document that survives contact with an opponent and one that merely looks expensive. This page is about the second part: identity resolution before research, independence as the scarce resource, the Admiralty two-axis grading system, a capture standard with a hash and an immutable copy, the six checks that catch fabricated or recycled material, the lawful boundary that constrains what may be collected, and the arithmetic behind timelines and fees. If you are commissioning an investigation rather than running one, the last two sections are the ones to read first.

What an OSINT investigation actually produces

A professional deliverable has five parts, and a report missing any of them is a summary rather than an investigation.

• An answer, on one page. The question you asked, answered directly, followed by the risk view: proceed, proceed with conditions, clarify, or stop. The reasoning comes after, not instead.
• Findings with their provenance. Each material statement carries its source, the date it was observed and a confidence level. Not a bibliography at the end - the citation sits with the claim, because the claim is only as good as the citation.
• An evidence pack. Captures of the records relied on, with the timestamp they were taken and a hash, so the finding can be checked after the page has changed or been deleted.
• What remains open. The questions the open sources could not answer, stated plainly, with the options for resolving them - a court application, a local registry search, a site visit, a subject access request.
• The method and its limits. Which sources were searched, which were not available in that jurisdiction, and what the investigation therefore cannot claim.

The three categories must stay separate in the writing: confirmed facts, open questions, material risks. Reports that blend them read fluently and are useless in a decision, because the reader cannot tell which sentence is a registry filing and which is an analyst's inference.

The question decides the method: four engagement shapes

OSINT is a data source, not a service. What you are buying is an investigative method applied to a decision, and the shape follows from the decision. Four recur often enough to be named.

What all four share is that the collection is the cheap part and the judgement is the expensive part. Anyone can search; the fee buys the identity resolution, the negative results, the grading and the discipline of writing something that a hostile reader cannot dismantle.

Identity fixing: the step nobody advertises and everything depends on

Before any research, the analyst has to establish which legal entity and which human being the evidence will attach to. Skip this and every subsequent record lands on a name that resembles your subject, which is how investigations produce confident reports about the wrong company. The failure is not rare; it is the standard failure of automated tooling, which matches strings rather than identities.

The mechanics are unglamorous. Fix the legal entity from the registry of the jurisdiction of incorporation: exact registered name, registration number, registered address, incorporation date. Then resolve the people: directors as filed, with dates of appointment and resignation, then the layer above if the shareholder is itself a company, and so on until disclosure stops - which is itself a finding worth stating. Attach the identifiers you can verify: a date of birth where the registry shows one, a business address, a corporate email domain. Never attach an identity on the strength of a shared name, a photograph that resembles another photograph, or a social profile that lists a matching employer.

Write the identity resolution down before the findings. A paragraph that states what was fixed, how, and where confidence stops is what allows a reader to see the limits of the rest. It is also the paragraph that exposes a provider who never did the work.

Independence is the scarce resource, not sources

Open source investigations drown in sources and starve on independence. Ten pages repeating a single press release are not ten corroborating sources; they are one source with ten reprints. The most common analytical error in this field is counting mirrors as agreement, and it produces exactly the false confidence that a careful adversary will exploit.

The test is mechanical: trace each citation to its ultimate origin. Press coverage usually derives from a single announcement, a single filing or a single anonymous brief. Wikipedia derives from citations, which derive from the same. Aggregator sites scrape each other. A company's own website is a primary source for what the company says about itself and no evidence at all for whether it is true. Group the citations by origin, and only then count groups.

• Primary and institutional - company registries, court dockets, insolvency registers, sanctions lists, regulatory actions, official gazettes, procurement records, land registries where public.
• Primary but self-interested - the subject's own filings, site, disclosures and marketing. Authoritative on claims, silent on their truth.
• Secondary reporting - journalism, trade press, analyst notes. Useful for leads and for dating events; derivable from a single origin.
• Tertiary and scraped - aggregators, people-search sites, data brokers, wiki mirrors. Useful only as an index back to something better, and frequently stale by years.

A finding built from one primary record is worth more than a finding built from twenty tertiary ones, and the report should say which is which. When a provider's evidence appendix is a list of URLs with no origin analysis, the confidence language in the summary is decorative.

The Admiralty code, and why two axes beat one score

The grading system worth using is the oldest one available: the Admiralty or NATO code, developed by British naval intelligence in 1939 and still the working standard in intelligence and in serious corporate investigation. It grades the source's reliability A to F and the information's credibility 1 to 6, and it insists the two be assessed independently.

That independence is the whole point. A usually reliable source - a national newspaper, say - can publish a specific claim that conflicts with a registry filing, which is a B4: decent source, doubtful information. A source you cannot judge at all can still hand you a document you can verify independently, which is an F1. Rating the source alone hides the second case; rating the content alone hides the first. Single-score risk systems collapse both into a number and lose the information that matters.

Calibration: what confidence words are allowed to say

Confidence language is where reports quietly lie. "It is proven that" and "the evidence establishes" are claims about certainty, and certainty is not available from open sources; what is available is a documented degree of confidence proportionate to the evidence. A calibrated report uses a small vocabulary and uses it consistently.

• Very high - several independent, consistent, high-reliability primary records. Expressed as: the available evidence establishes with high confidence that.
• High - reliable supporting evidence and no inconsistent diagnostic evidence. Expressed as: the collected evidence supports the hypothesis that.
• Moderate - partially confirmed, with relevant gaps. Expressed as: in the absence of verified contrary information, this appears more supported than the alternative.
• Low - insufficient to include or exclude. Expressed as: open question, with the options for resolution.

Two rules keep the vocabulary honest. First, confidence cannot exceed the grade of the evidence supporting it: a single A2 record does not license "very high", because very high requires convergence of independent sources, not one excellent one. Second, the conclusion phrases must never assert the act. An investigator establishes that records show a payment, that a company was dissolved, that a domain was registered by a privacy service on a date. Whether a person committed a crime is a legal finding, and it belongs to a court, not to a report.

This is not pedantry. Reports that overclaim get disclosed, attacked and withdrawn, and the withdrawal costs more than the investigation. The calibrated version is also more useful: a decision-maker who knows which three facts are A1 and which two are C3 can act on the first three and commission follow-up on the rest.

The capture standard: one hash, six fields, an immutable copy

Open sources change. Pages are edited, accounts are deleted, marketplaces close, and by the time anyone checks, the finding is unverifiable. Every material artefact therefore needs to be captured at the moment it is observed, in a form that proves it was not altered afterwards.

Where possible, take a full-page DOM capture in addition to the screenshot: a screenshot can be cropped, recoloured or relabelled in seconds, and a rendering of the page with its assets can be re-examined for elements that fell outside the visible area. Keep the original file, not the annotated version, and keep the annotation as a separate layer. If an analyst has redacted personal data before filing the capture, hash both the original and the redacted copy and state the redaction in the appendix - an unrecorded edit is what destroys credibility in a disclosure.

The test to apply to any provider's evidence pack: could you, six months from now, hand the report to someone who distrusts you and have them verify each finding without asking the analyst anything? If the pack is screenshots pasted into a document, the answer is no, and the report is an opinion with decoration.

What open sources cannot establish

Half the value of a good OSINT report is the list of things it declines to claim. Four categories are structurally out of reach, and any report that reaches them is either guessing or dressing an inference as a finding.

• Private facts. Bank balances, unlisted phone numbers, private messages, medical records, home addresses that are not in a public register. A provider who promises these is promising either a data broker dump of uncertain legality or an intrusion. Both are your liability, not theirs.
• Attribution on technical evidence alone. An IP address, a domain registration and a leaked handle suggest a person; they do not identify one. Carrier-grade NAT, VPN exits, resold infrastructure and shared devices mean the same address can represent thousands of people. Attribution requires a join to something non-technical: a payment, a signed communication, a device, a legal process.
• Intent. Open sources show what was said, published, filed and registered. They do not show motive, and the leap from conduct to intent is the leap that defamation claims are built on.
• Anything behind authentication. A private group, a gated forum, a paid marketplace, a personal account. Accessing them requires credentials you are not entitled to use; that is not OSINT, whatever the sales deck says.

State these limits in the report, in the same section as the findings, not in a disclaimer at the back. A reader who understands what was out of reach can weigh what was found; a reader who discovers the boundary later discounts the whole document.

Fabricated evidence: six checks for 2026

Two decades of OSINT practice assumed that a photograph was a photograph and that a profile belonged to someone. Neither holds. Generative models produce convincing portraits, product photos of companies that do not exist, and fake documents; and cheap account farms produce personas with history, followers and cross-links. Verification is now a routine step rather than a specialism.

1. Earliest appearance. Find the first indexed instance of the image or claim, not the most popular. A file that appears in 2024 on three sites simultaneously, with identical compression artefacts, has one origin and possibly no provenance.
2. Reverse image search across several engines, then compare the earliest hit's context with the claimed context. Reused stock, a different city, a different year.
3. Archive first-crawl date from a web archive for the page, and for the domain's registration date. A company site claiming fifteen years of trading on a domain registered eighteen months ago is a finding.
4. Generator artefacts and metadata - absent EXIF where a camera should have written it, implausible lens and sensor combinations, text rendering errors, hands and background symmetries. Treat these as indicators, never as proof: metadata can be stripped by any messaging app, and modern models defeat most single checks. Where the material is central, commission a synthetic-media analysis rather than eyeballing it - the same discipline as deepfake detection in a dispute.
5. Persona consistency under time pressure. A synthetic persona has a shallow history: a small number of posts clustered in a short window, engagement from accounts created in the same week, a biography that never contradicts itself because it never contains a specific. Ask for a detail that should exist - an employer's address, a colleague's name, a dated photograph of a workplace - and watch whether it arrives.
6. Document forensics on any registry extract or filing. Fetch the record from the registry yourself rather than trusting the PDF you were sent. The registry is the source; the PDF is a claim about the source.

The practical consequence for commissioning: if a finding is going to matter, it needs to survive one more step than feels necessary. The check is cheap; the cost of discovering a fabrication after disclosure is not.

The lawful boundary: what may be collected and from where

Open source work is lawful because it touches only what is public: a page anyone can load, a registry anyone can search, a filing anyone can buy. The moment the method requires a pretence, a borrowed credential, a purchased database of personal records or a paywall bypass, it stops being OSINT and the risk transfers to whoever commissioned it. Four boundaries are worth stating to any provider before work begins.

Two practical controls make the boundary real rather than aspirational. The engagement letter names the permitted methods and requires written approval for anything outside them. And the data handling schedule states what will be retained, for how long, where, and who will delete it, with a certificate of destruction at the end. Ask for both; providers who cannot produce them are improvising.

The same discipline protects you in the opposite direction: if the subject of an investigation asks how their data was obtained, a documented method is your defence, and an undocumented one is a problem with your name on the invoice.

Timelines, cost and what moves the price

Published ranges cluster tightly because the unit of work is the analyst-day. A focused check on one subject in one or two jurisdictions runs from about ten business days; a standard investigation covering a subject and its network with ownership mapping runs two to three weeks; complex multi-jurisdiction work with offshore layers and asset tracing runs up to a month and is often phased. Urgent delivery typically carries a surcharge in the region of 50 per cent, and the credible providers publish a service level in the other direction as well - a fee reduction if they miss the agreed date.

The fee is driven by five things, in roughly descending order of impact: the number of subjects, the number of jurisdictions, the depth of ownership or network mapping, how thin the public records are, and the deadline. Thin records is the variable clients underestimate. A company in a jurisdiction with a searchable registry and digitised filings can be resolved in days; the same company behind two layers in a jurisdiction where filings are paper-only and require an in-person search can consume a week per layer.

What to refuse: a per-database fee schedule, which prices access rather than analysis; a fixed report with no scope document; hourly billing with no cap; and any proposal where the confidence language is promised but the evidence appendix is not. The last one tells you the grade labels will be assigned by the sales team.

Monitoring is not investigation, and the retainer is not a subscription

The most common commercial confusion in this market is between an investigation and a monitoring service, and it leads to buying the wrong one. An investigation answers a question once, against a decision with a date. Monitoring watches a defined surface continuously for change: new impersonation domains, credentials appearing in stealer logs, executive details surfacing in a market, typosquats resolving to a phishing kit.

The deliverables differ accordingly, and so should the contract. A monitoring retainer needs a defined surface and an alerting threshold, an owner on your side, a stated response time, and a periodic summary that states what was watched and what changed - four things that can be counted. An investigation needs a question, a scope of subjects and jurisdictions, a delivery date, an evidence pack and a debrief. A provider who sells a year of monitoring and calls the quarterly summary an investigation is selling you a newsletter.

They pair well when the split is explicit: monitoring catches the routine and the continuous, and a small allocation of analyst days is held for the cases that need someone to think - an impersonation that persists after takedown, a leak with a plausible insider, a counterparty whose ownership does not resolve. That structure gives you the trend line and the depth without paying investigative rates for what a query should do.

A worked example: supplier due diligence in ten days

To make the method concrete, here is a realistic shape for a focused review, with the confidence language the report should use. The question: can we appoint this supplier for a three-year contract touching customer data?

1. Identity. Legal entity fixed from the registry of incorporation - exact name, number, registered address, incorporation date. Two A1 records. A trading name used on the website is not registered to the entity; one B2 finding that it belongs to a different company in the same group.
2. Ownership. Shareholders as filed, then the layer above. Disclosure stops at a corporate shareholder registered in a jurisdiction with nominee arrangements; stated as an open question rather than as concealment, with the option to request the ownership chart contractually.
3. Financial and legal record. No insolvency filings in the last five years, one county court judgment for a modest sum, satisfied. A2 and A1 respectively. One adverse media item from 2021, traced to a single trade-press origin and not corroborated - C3, reported as such and not counted as a second finding.
4. Sanctions and debarment. Entity and named directors screened against consolidated lists on the observation date, no match. State the lists, the date and the screening method; "no sanctions" without a date is worthless.
5. Technical and digital footprint. Domain registration date, mail infrastructure, hosting, certificate history, exposure of internal systems, and a check of the claimed certifications against the issuing body rather than the website badge. One claim - a certification the issuer's directory does not show - reported as unconfirmed with the request to produce the certificate.
6. Claims versus records. The client-count and years-of-trading claims compared with filings and with the domain's first archive capture. One discrepancy, moderate confidence, framed as a question to ask rather than an accusation.

The output is a two-page answer with a proceed-with-conditions recommendation, an appendix of graded findings with sources and observation dates, an evidence pack with hashes, and a list of four questions for the counterparty. Nothing in it is dramatic, and that is the point: the value is that a lawyer on the other side can check every line, which is precisely what makes the conditions enforceable.

What to ask a provider before you sign

Seven questions separate an investigative practice from a reseller of database access, and the answers are quick to obtain.

• "Show me a redacted report from a case like ours." Read the evidence appendix and the confidence wording, not the executive summary. If findings carry no grades and no observation dates, the method is not there.
• "How do you fix the identity before research?" A specific answer - registry of incorporation first, identifiers listed, joins justified - indicates a method. A vague one indicates a search box.
• "What will the evidence pack contain?" Canonical URLs, UTC timestamps, hashes, archive references, tool versions. If the answer is screenshots in a document, ask what happens when a page is edited before the dispute.
• "Who does the work, and who signs off?" Named analysts and a senior reviewer who can change a conclusion. The review step is where most errors are caught and it is the first thing a low-cost provider removes.
• "Which sources will you not use?" A provider with no prohibited sources has no data protection analysis. The correct answer names broker dumps, breached credentials, pretexting and paywall bypasses as out of scope.
• "What are the limits of this engagement in writing?" Jurisdictions not covered, sources unavailable, questions that will remain open. A provider who claims completeness has not read their own report.
• "What happens to our data at the end?" Retention period, storage location, deletion evidence. If the answer is that it stays in the case management system indefinitely, ask for that in writing and decide whether you want it.

Credentials are useful context rather than evidence of quality: a professional investigations licence where the jurisdiction requires one, professional indemnity insurance sized to the engagement, and analysts with a documented background in research, law, finance or intelligence. Insurance matters more than most buyers expect - an investigation that names a person incorrectly is a defamation exposure, and it lands on whoever published it.

The bottom line

An open source investigation is worth what its worst paragraph is worth. If one finding cannot be reproduced from the evidence pack, the confident findings beside it lose their force, because the reader now knows the document contains at least one claim that was not checked. That is why the discipline described here - identity fixed before research, independence counted rather than assumed, two-axis grading, a capture standard with a hash, calibrated confidence language, fabrication checks, and a lawful boundary written into the engagement - is not bureaucracy layered on the real work. It is the work.

If you are commissioning: ask for the report sample, the evidence pack specification and the data handling schedule before you discuss price, because the price only means something once you know what is being delivered. If you are running the investigation yourself: write the answer first, grade every claim, and delete the sentence you cannot source.

Our digital forensics practice runs open-source investigations alongside device and account work, so an OSINT finding that needs technical corroboration does not stall at the handover; evidence handling in legal cases covers the chain-of-custody side in more depth, and corporate email compromise investigations shows the same grading method applied to an intrusion. For the social-media end of the discipline, OSINT on social platforms sets out what a public account can and cannot establish. When you are ready to scope a case, send us the question and the decision date - those two facts determine the method, the timeline and the fee.