| name | people-osint |
| description | Gather people- and organization-focused OSINT for an authorized social-engineering assessment — org structure, roles, contact patterns, and public footprint that inform realistic phishing/pretext scenarios. Use only within an authorized engagement; focus on assessing susceptibility and improving awareness. |
Goal
Enough organizational and personnel context to design realistic social-engineering
test scenarios (and to inform defensive awareness) — without overcollecting or
crossing ethical/legal lines.
Scope & ethics first
- Only within an authorized engagement with agreed rules of engagement.
- Collect from public sources; gather the minimum needed for the assessment.
- The objective is to measure susceptibility and improve awareness/controls, not
to harm or harass individuals. Handle personal data with care; minimize and protect
it; respect privacy law.
What to gather (organization-centric)
- Structure & roles — departments, reporting lines, key functions (finance, IT,
HR — common phishing targets), and high-value roles.
- Contact patterns — corporate email format, naming conventions, public contact
info, out-of-office/role mailboxes.
- Public footprint — professional profiles, conference talks, public posts that
reveal tooling, processes, or pretext hooks (events, vendors, projects).
- Pretext material — current initiatives, partners, and vendors that make a
believable, testable scenario.
Steps
- Confirm authorization and RoE; define what's in scope and off-limits.
- Collect organization-level context and the email/naming pattern.
- Build realistic, role-appropriate scenarios (e.g. vendor/IT/HR themes) for the
authorized phishing/vishing test.
- Keep records minimal and protected.
Output
An assessment-support pack: org/role map · email/naming pattern · candidate pretext
themes · suggested target roles (by function, not gratuitous personal detail). Use
security-reporting; results inform awareness training and email controls.
Notes
Stay authorized, public-source, and minimal — this measures and improves resilience,
it is not a license to profile or harm people. Finance/IT/HR are common targets;
weak SPF/DMARC (see exposure-discovery) makes spoofing easier and is a key
defensive fix.
