Build Your OwnOSINT threat profile.

A passive OSINT assessment maps what is already publicly visible about your organisation — your infrastructure, credentials, technology stack, and compliance gaps — without accessing any of your systems. If you have never had one, your external footprint has never been reviewed from the outside. That footprint exists regardless.

Every staff departure creates a potential credential risk. Former employees retain access to external platforms they used — regardless of whether your internal systems have been updated. High turnover means a growing number of email addresses and credentials associated with your domain that are no longer under your control. These appear in breach intelligence databases and are actively traded.

Every external platform your organisation uses holds credentials, data, or access associated with your domain. Each one has its own breach history — independent of your internal controls. When any of them is compromised, data about your organisation enters criminal markets. The more platforms you use, the more exposure points exist beyond your direct visibility.

The sensitivity of your data determines attacker motivation and regulatory consequence in a breach. A threat actor profiling your organisation will infer your data holdings from your sector, job listings, privacy policy, and registered entity structure — often before any technical reconnaissance begins. The higher the value of what you hold, the more thoroughly your organisation has already been mapped.

Security maturity is an internal measure. It describes what controls you believe you have in place — not what is externally visible. Organisations with high internal maturity ratings frequently carry significant external exposure because their assessment frameworks look inward, not outward. The gap between what you have implemented and what an attacker can already observe is often larger than any internal audit has measured.

Data location is both a compliance obligation and a target signal. Where your data sits determines which regulators have jurisdiction in a breach, which legal frameworks may compel disclosure, and which threat actors are motivated to pursue it. Most organisations are less certain about data location than they believe — and that uncertainty is itself a material finding under the Australian Privacy Act.