Skip to content

OSINT & Phishing Simulation

Test the human factor and uncover public attack surfaces

Attackers rarely start with a technical exploit – they start with research. Through Open Source Intelligence (OSINT), they gather publicly available information about your organization, your employees, and your infrastructure. With this information, they craft tailored phishing attacks that can deceive even trained employees. Our OSINT and phishing simulations uncover exactly these attack surfaces – before a real attacker exploits them.

What is OSINT?

Open Source Intelligence (OSINT) refers to the systematic collection and analysis of publicly available information. Attackers use OSINT to gather email addresses, organizational structures, technical infrastructure details, and personal information about employees – all without directly attacking a single system. This information serves as the foundation for targeted social engineering attacks and phishing campaigns.

Phishing remains the most common initial attack vector in cyberattacks. Even the best technical defenses can be bypassed by a single employee click. That is why it is crucial to regularly test the human factor and sharpen awareness of social engineering risks.

OSINT Analysis

Dark Web Monitoring

We search relevant darknet forums, marketplaces, and paste sites for mentions of your organization, leaked data, or credentials being sold.

Leaked Credentials

We check whether your employees' credentials have appeared in known data breaches. We identify compromised accounts and assess the risk of credential-stuffing attacks.

Social Media Exposure

Analysis of the public social media presence of your organization and employees. What information can attackers use for targeted attacks?

Domain Intelligence

Investigation of your domains, subdomains, DNS configurations, and exposed services. We identify forgotten assets, misconfigured entries, and potential attack vectors.

Phishing Simulation

Targeted Spear Phishing Campaigns

Based on OSINT results, we craft tailored phishing emails targeting specific departments, roles, or individuals – exactly as a real attacker would.

Awareness Measurement

We measure in detail how your employees respond to phishing attempts: open rates, click rates, credential submissions, and reporting rates. This gives you a clear picture of the awareness level across your organization.

Technical Filter Testing

At the same time, we test the effectiveness of your technical email security: spam filters, DMARC/SPF/DKIM configurations, URL rewriting, and sandbox solutions.

Who Is This For?

Our Methodology

01

OSINT Gathering

Systematic collection of publicly available information about your organization, employees, and infrastructure.

02

Attack Scenario Design

Development of realistic phishing scenarios based on the collected OSINT data and your company profile.

03

Phishing Campaign Execution

Controlled execution of the phishing campaign with real-time tracking of all interactions.

04

Results Analysis & Reporting

Detailed evaluation of all results with concrete recommendations for improving your security posture.

From Our Engagements

Anonymized engagement example

A Swiss manufacturing company. 120 employees. 15% hand over their credentials.

MFA activated for all employees, targeted awareness training conducted, public documents cleaned up. Follow-up campaign three months later: click rate reduced from 34% to under 5%.

87 emails reconstructed 34% click the link 15% enter credentials
Industry: Manufacturing
Scope: OSINT + 1 phishing campaign
Duration: 5 days

A Swiss manufacturing company with 120 employees wants to find out how much information about the company and its employees is publicly available — and whether staff would fall for a targeted phishing campaign.

Key Findings

  • High 87 employee email addresses reconstructed via LinkedIn and public sources. 12 passwords found in breach databases.
  • High Phishing campaign: 34% of recipients click the link, 15% enter their credentials on the fake login page
  • Medium Technical documents containing internal IP addresses and network topology found on the public website

Your Deliverables

OSINT Dossier

Comprehensive dossier of all publicly discoverable information about your organization – including dark web findings, leaked credentials, exposed infrastructure, and social media risks.

Phishing Campaign Results

Detailed evaluation of the phishing campaign with open rates, click rates, credential submissions, and timing analysis – broken down by department and scenario.

Employee Awareness Metrics

Measurable metrics on your employees' security awareness: reporting rates, response times, and comparison with industry benchmarks.

Recommendations & Measures

Prioritized recommendations for reducing the OSINT attack surface, improving email security, and strengthening employee awareness.

from CHF 4,500

Typical duration: 5–10 days

Book a Free Consultation

Why Manual Testing?

Frequently Asked Questions

OSINT (Open Source Intelligence) is the systematic analysis of publicly available information about your organization – e.g., exposed email addresses, employee data, or technical infrastructure. Phishing simulations use these findings to create realistic attack emails and test the human factor. Both methods complement each other and cover different attack vectors.

That depends on your goals. For realistic results, we recommend running the simulation covertly – only management and possibly the IT department are informed in advance. After completion, all participants receive a constructive debriefing with awareness tips. We do not name individuals in the report.

Typical findings include: exposed email addresses and passwords from data breaches, employee information from social networks, technical details such as subdomains, IP ranges and technologies in use, publicly accessible documents with metadata, and information from code repositories or cloud storage.

All results are treated confidentially and reported only in aggregate form. We provide statistics on open rates, click rates, and credential submissions, along with concrete recommendations for improving security awareness. Individual employees are not named – the focus is on organizational improvements.
Book a Consultation