Corporate security has two very different risk surfaces to watch: who you let in the door, and who’s already inside. Vendor screening is about the first. Insider risk is about the second. Both have become significantly more dependent on open-source intelligence over the last few years, for the same underlying reason — self-reported questionnaires and point-in-time checks simply don’t hold up against risks that change continuously.
Here’s how corporate security and GRC teams actually use OSINT across both problems, where it’s genuinely effective, and where it needs careful handling.
Why vendor questionnaires alone stopped being enough
Traditional vendor due diligence relied heavily on a vendor filling out a questionnaire about their own security posture, financial standing, and compliance status, then re-checking it once a year if at all. The obvious problem: vendor self-disclosures naturally present the vendor in a favorable light, and a lot can change in the eleven months between annual reviews. OSINT-powered vendor risk programs replace that static snapshot with continuous, objective monitoring, pulling in breach history, exposed infrastructure, and dark web activity without relying on the vendor to self-report any of it. Security rating services now provide ongoing visibility into a vendor’s external posture, perimeter vulnerabilities, credential exposures, patch management, the same kind of continuous attack-surface awareness covered in our post on S3 misconfiguration breaches, applied to a vendor’s infrastructure instead of your own.
A tiered approach, matched to actual risk
Mature vendor risk programs don’t apply the same depth of screening to every relationship. A common structure looks like:
- High-risk vendors — those with deep system access, sensitive data exposure, or critical operational dependency — get comprehensive OSINT screening, independent evidence validation, and ultimate beneficial ownership (UBO) mapping to understand who actually controls the company.
- Medium-risk vendors get a standardized questionnaire alongside media and sanctions screening.
- Low-risk vendors get a streamlined onboarding check: automated sanctions, politically exposed person (PEP), and adverse media screening.
This tiering matters because comprehensive OSINT on every vendor relationship isn’t practical at scale, but skipping it entirely for anything beyond a basic check leaves exactly the kind of gap a determined bad actor, or a vendor quietly in financial trouble, can hide behind.
What this screening actually catches
One documented example illustrates the value well: a due diligence review exposed doctored timelines in a vendor’s proposal after metadata revealed the documents’ actual creation dates were inconsistent with the milestones the vendor claimed to have already completed. That’s not a finding a reference check or an interview would likely catch, it required actually examining the underlying files, which is exactly the kind of verification OSINT methodology is built around.
Beyond document metadata, a real vendor OSINT review typically checks:
- Security posture and breach history, including whether the vendor’s own infrastructure shows signs of compromise or neglect.
- Sanctions, PEP, and adverse media screening, to catch undisclosed connections to sanctioned entities or individuals in positions of political influence.
- Beneficial ownership mapping, since a vendor’s publicly listed leadership isn’t always who actually controls the company, and this is where the link analysis techniques covered elsewhere in this series directly apply.
- Undisclosed affiliations or conflicts of interest, such as a vendor secretly connected to a competing bid or an internal decision-maker.
Why this is increasingly a compliance requirement, not just best practice
This shift isn’t purely a security team’s preference anymore. Regulations including the EU’s Digital Operational Resilience Act (DORA) for financial services, the Corporate Sustainability Due Diligence Directive (CSDDD), and GDPR increasingly obligate organizations to maintain documented, auditable, risk-aligned due diligence on their third parties, not just a one-time check at onboarding. Regulators expect to see the process, not just the conclusion, which is part of why OSINT’s inherent traceability, every finding tied to a source, every source checkable, fits this requirement well.
The other half: insider risk
Vendor screening looks outward. Insider risk looks inward, at the far more sensitive question of whether someone already inside the organization poses a risk, intentionally or not. OSINT supports this in a narrower, more specific way than it does vendor screening:
- Monitoring paste sites and leak forums for signs of internal data, credentials, source code, or confidential documents, being shared externally, intentionally or through negligence.
- Watching developer platforms, since internal code accidentally pushed to a public repository with embedded credentials or proprietary logic remains a surprisingly common and entirely public leak.
- Tracking public mentions of the organization in forums and social platforms where a disgruntled or departing employee might signal intent before acting on it.
This is meaningfully different from vendor screening, and it deserves more caution, not less.
Why insider risk OSINT needs tighter guardrails
Monitoring a vendor’s public infrastructure is one thing. Monitoring an employee’s public footprint is another, with real legal and ethical weight attached:
- Scope it to legitimate security purpose, documented in advance, not open-ended curiosity about any employee’s personal life or opinions.
- Involve legal and HR before building any insider-risk OSINT process, since employment law, privacy expectations, and what’s actually permissible vary significantly by jurisdiction and can differ meaningfully from what’s permissible in vendor screening.
- Focus on organizational risk indicators, data exposure, leaked credentials, public code leaks, not general surveillance of an employee’s personal social media activity unrelated to any security concern.
- Treat a flag as a lead, not a verdict. As covered in our post on the human-in-the-loop problem, a single public post or a pattern an algorithm surfaces needs human review and context before it becomes part of any personnel decision.
- Pair this with solid offboarding discipline. As covered in our post on employee offboarding, a large share of insider risk comes from access that should have been revoked and wasn’t, a gap no amount of monitoring fixes if the underlying access controls are weak.
The bottom line
OSINT has become a core part of both halves of corporate security risk, continuous vendor monitoring that catches what a self-reported questionnaire never would, and narrowly scoped insider risk detection that watches for genuine data exposure rather than general employee surveillance. The vendor side benefits from going deep and continuous. The insider side benefits from going narrow and carefully governed, with legal and HR involved from the start, not brought in after a process already exists.
This builds directly on our earlier posts on link analysis, employee offboarding, and the human-in-the-loop problem, all worth reading alongside this one if you’re building out either of these programs.
Leave a Reply