Targeted investigations using open and lawfully accessible sources
Research into specific situations using open and lawfully accessible sources. The work examines facts, relationships between people and companies, digital footprints, corporate structures, public statements, and conflicting information. The result is a verifiable account of events, supporting sources, and analytical findings with confidence assessments where appropriate.
The work begins with a defined unknown: what happened, whether a suspected relationship exists, who is associated with a digital asset, how people and companies are connected, or whether a particular claim can be verified.
People, companies, domains, addresses, documents, corporate records, and other identifiers are analyzed together. A relationship is included in the findings only when it is supported by a sufficient combination of independent indicators.
Changes in websites, corporate records, ownership, public statements, and other relevant data are organized chronologically. This helps establish not only what is known now, but how the situation developed over time.
The investigation is not designed to prove a predetermined conclusion. Evidence that supports and challenges the initial hypothesis is reviewed, and the working explanation changes when the sources support a different conclusion.
Material facts are tied to their sources, dates, and context. The report distinguishes verified information, analytical findings, contradictions, and information that could not be confirmed with sufficient confidence.
The investigation is structured around the original question. The client receives an evidence-based account of the situation, verified relationships, material contradictions, research limitations, and analytical findings with confidence assessments where appropriate.
When you need to establish what actually happened
An OSINT investigation is appropriate when there is a specific question, contradiction, unknown relationship, or event that cannot be reliably explained through a single database check or isolated source.
Unlike Due Diligence, where the subject is known in advance and the objective is to evaluate a company or relevant individuals before a transaction or other commitment, an OSINT investigation begins with a problem. This may involve an unknown relationship between companies, conflicting public statements, the origin of a digital asset, changes in a corporate structure, a disputed sequence of events, or the need to test a specific hypothesis.
The investigation may involve people, legal entities, websites, domains, documents, publications, archived materials, corporate records, and other lawfully accessible information. These elements are not reviewed in isolation, but as parts of the same underlying situation.
Information provided by the client is treated as a starting point, not as established fact. If two companies are believed to be connected, the purpose of the investigation is to determine whether the relationship can be supported by evidence — not to collect arguments that merely confirm the original suspicion.
Alternative explanations, newly identified entities, and evidence that conflicts with the initial theory may emerge during the investigation. Such information is not excluded simply because it does not support the original hypothesis.
If the available evidence does not support the hypothesis, that is also a valid research outcome. A lack of evidence is not replaced with speculation.
A shared address, matching phone number, common domain, archived page, or document metadata does not by itself establish a relationship. These indicators are evaluated alongside corporate records, time periods, other identifiers, and independent sources.
Relationship maps and timelines may be developed when they help clarify how entities and events connect. This is particularly useful when an investigation involves multiple companies, individuals, domains, or significant changes over time.
The goal is not to produce the most complex diagram possible. The goal is to explain the situation through the clearest path from evidence to conclusion.
Research is conducted using lawfully accessible open sources and appropriately licensed information services. It does not provide access to private accounts, closed government or commercial systems, private communications, banking information, or other data that would require unauthorized access.
There are also limitations inherent in the available sources. Some information may never have been published, may have been deleted, may be unavailable in a particular jurisdiction, or may exist only in closed systems.
A professional investigation therefore identifies not only what can be established, but also where the available evidence ends.
Investigation Outcome
The result is built around the original question: what was verified, which relationships were established, which hypotheses were challenged, and where the available evidence is insufficient for a reliable conclusion.
Information from multiple sources is verified and cross-checked. Only information supported by a sufficient evidence base is presented as established fact in the final report.
When the investigation involves multiple people, companies, domains, or other entities, supported relationships between them can be organized into a common structure and visualized.
Where relevant, events and changes are reconstructed in chronological order. This helps clarify sequence, changes in roles, and relationships between separate developments.
When official records, publications, archived data, or public statements conflict, the discrepancies are analyzed separately, with an assessment of which account is better supported by the available evidence.
The original hypothesis may be supported, partially supported, or rejected. The outcome is determined by the evidence, not by the client’s expectations or the initial theory.
Key findings are supported by sources and, where appropriate, confidence assessments. Research limitations, unresolved issues, and areas that could not be independently verified are identified separately.
How an OSINT Investigation Works
The investigation develops iteratively: the initial question determines the first set of sources and entities, new information creates additional lines of inquiry, and competing explanations are then tested against the available evidence.
The first step is to define exactly what needs to be established: a fact, relationship, sequence of events, origin of a digital asset, credibility of a claim, or another specific unknown.
Stage result: a clearly defined question that the investigation is expected to answer.
Available information, known entities, and initial assumptions are reviewed. Working hypotheses are documented separately and are not treated as established facts.
Stage result: the initial theories and information requiring verification are defined.
Names, companies, registration numbers, addresses, websites, domains, phone numbers, email addresses, and other identifiers are checked to reduce the risk of conflating different entities.
Stage result: a reliable set of identifiers is established for the entities under investigation.
Official records, corporate data, websites, archived pages, publications, documents, digital footprints, and other relevant lawfully accessible sources are reviewed.
Stage result: a structured body of information with documented provenance and context.
Where relevant, domains, websites, archived pages, published documents, metadata, and other elements of digital presence are analyzed for indicators that may support activity, attribution, or relationships between entities.
Stage result: relevant elements of the digital footprint are identified and their connection to the subjects is assessed.
People, companies, addresses, executives, owners, domains, documents, and other indicators are compared across sources. Potential relationships are tested against multiple independent indicators.
Stage result: potential matches are separated from relationships that are sufficiently supported by evidence.
When the question involves events unfolding over time, relevant developments are organized into a common chronology: company registrations, ownership changes, publications, website changes, the appearance of digital assets, and other material events.
Stage result: a verifiable sequence of relevant events.
Each material hypothesis is tested against the collected evidence. The analysis considers not only supporting indicators, but also facts that could contradict or materially change the initial explanation.
Stage result: hypotheses are classified as supported, partially supported, unresolved, or inconsistent with the available evidence.
Verified facts, relationships, and events are combined into a coherent account. Material analytical conclusions are assessed based on source quality, independence of corroboration, and any remaining contradictions.
Stage result: the original questions are answered to the extent supported by the evidence, with confidence assessments applied to material findings where appropriate.
The final deliverable includes an executive summary, established facts, verified relationships, material contradictions, analytical findings, sources, and research limitations. Relationship maps and timelines may be included where they improve understanding.
Stage result: a verifiable report that addresses the specific question that initiated the investigation.
Pricing Principles
Pricing is based on the research question, number of entities, complexity of the relationships, volume of relevant sources, and depth of verification required. The amount of information collected is not, by itself, a measure of the investigation’s value.
Unlike a standard company verification, the boundaries of an OSINT investigation cannot always be determined precisely in advance. A single verified fact may resolve the question quickly, while another finding may reveal an additional network of entities that requires further investigation.
When the scope can be defined before work begins, the engagement is priced on a fixed-fee basis. Open-ended investigations may be billed at $75 per hour with a pre-agreed budget cap. Work beyond that limit begins only after additional client approval.
| Engagement | What It Includes | Pricing |
|---|---|---|
| Targeted OSINT Research | One clearly defined research question, a limited number of entities and sources, verification of specific facts or a specific relationship, and a concise written deliverable. | from $900 |
| OSINT Investigation | Multiple interconnected entities, hypothesis testing, digital footprint analysis, corporate and relationship research, review of contradictions, source verification, and a structured investigation report. | from $1,500 |
| Complex OSINT Investigation | A larger number of people, companies, or digital assets, complex relationship networks, historical reconstruction, timelines, multiple jurisdictions, and an expanded analytical report. | Custom quote |
| Open-Ended Investigation | Research where the depth of the investigation and the number of emerging lines of inquiry cannot be reliably determined before work begins. | $75/hour with a budget cap |
Paid registries, official documents, licensed information services, translations, local research support, and other third-party expenses are quoted separately and approved before they are incurred.
If the investigation identifies a new and materially separate research question, that work is not automatically included in the original scope and is quoted separately.
No Fine Print
Practical questions about investigative scope, lawful sources, hypothesis testing, relationship analysis, digital footprints, evidence, and the limits of open-source research.
Due Diligence is typically conducted before a transaction, partnership, or investment and provides a broader assessment of a known company and relevant key individuals.
An OSINT investigation begins with a specific question or problem: establishing a relationship, testing a claim, reconstructing a sequence of events, determining the origin of a digital asset, or resolving conflicting information.
Examples include whether two companies are connected, who was associated with a particular website or project, when a relationship emerged, whether a public claim can be verified, how a corporate structure changed over time, or which account of an event is better supported by open sources.
The research question is defined as precisely as possible before substantive work begins so that the investigation has a clear and verifiable objective.
Sometimes. Corporate records, addresses, executives, owners, domains, documents, digital identifiers, historical records, and other relevant indicators may be compared.
A single match is not sufficient by itself. A relationship is treated as established only when the available evidence provides a sufficiently supported basis for that conclusion.
Sometimes attribution is possible through a combination of open and historical information, such as registration records, archived pages, technical and corporate relationships, published documents, and other relevant indicators.
If the available evidence is insufficient for reliable attribution, that limitation is stated directly. A suspected association is not presented as an established fact.
Yes, when sufficient historical sources remain available. Web archives, historical corporate records, publications, documents, and other materials may be used to reconstruct a sequence of changes or events.
The completeness of the reconstruction depends on what information was originally published, what has been preserved, and what remains lawfully accessible.
It is revised or rejected. The purpose of the investigation is to establish the best-supported account of the situation, not to validate the client’s initial suspicion.
If independent evidence contradicts the original hypothesis, that contradiction is reflected directly in the findings.
Lawfully accessible posts and other public social media material may be reviewed when relevant to the research question and appropriate for the context of the engagement.
A social media post is not automatically treated as reliable simply because it is publicly visible. Material claims require additional verification whenever reasonably possible.
No. Research is conducted using lawfully accessible open sources and appropriately licensed information services.
The work does not involve hacking, credential theft or guessing, unauthorized access to accounts or closed systems, purchasing stolen or unlawfully obtained data, malware, or circumvention of technical security controls.
No. The outcome depends on the existence, availability, and reliability of relevant information. Some data may never have been published, may have been removed, or may exist only in closed systems.
If the available evidence supports only a partial answer to the original question, that limitation is stated explicitly in the report.
Relationships are assessed using a combination of identifiers, independent sources, temporal context, and other supporting indicators. A matching name, address, domain, or other single attribute is treated as a lead for further research, not as proof by itself.
A confidence assessment indicates how strongly the available evidence supports a particular analytical finding. It considers source quality, independence of corroboration, the number of supporting indicators, completeness of the available information, and material contradictions.
It is not a mathematical probability and does not replace the underlying evidence.
The client should explain the underlying problem and provide any information already available, such as names, companies, domains, documents, dates, links, or other relevant starting points.
Most importantly, the specific question that needs to be answered should be defined clearly. A precise research question helps keep the investigation focused on information that is material to the outcome.
The format depends on the engagement. It may include an analytical brief, a full investigation report, a relationship map, a timeline, entity profiles, or a combination of these formats.
The final deliverable includes established facts, supporting sources, verified relationships, analytical findings, confidence assessments where appropriate, and clearly stated research limitations.
Yes. OSINT investigations often identify new entities, relationships, or questions that could not reasonably have been anticipated at the beginning of the engagement.
If new information materially expands the original scope, the additional line of inquiry is scoped separately with its own timeline, pricing, and expected deliverable.
Get in touch
Describe what needs to be established, verified, changed, or resolved, and what outcome you expect. The more precise the starting information and context, the faster I can determine the appropriate scope and working format. All messages are transmitted over a secure connection and encrypted in transit.
All fields marked with are required.