HR articles

What Is OSINT? How HR and Recruiters Use Open Source Intelligence

2026-10-17 13:33
SHORT ANSWER

OSINT (open source intelligence) is the collection and analysis of information from publicly available sources — today, mostly the internet. Recruiters use it to find resumes and candidates who are not applying, to find their public contact details and to research a person before a conversation. HR uses it to study the market and competitors. The core skills are search hypotheses, Boolean operators and X-ray search.

Course on this topic: OSINT Course: People Search and Investigation Training

Most recruiters already do OSINT. They just call it “googling the candidate”. The difference between googling and OSINT is method: you know what you are looking for, you know where it is likely to be, and you know how to ask the search engine so that it gives you exactly that.

In 21 years in HR I have used these techniques in a bank, a TV group, a game developer and software companies. This guide covers what OSINT is, how HR and recruiters use it, the seven steps of a search, strings you can copy and the ethical lines you should not cross.

If you want to start with practice, go straight to the free X-ray search string builder.

What is OSINT?

OSINT (open source intelligence) is the collection and analysis of information from publicly available sources. Today that means mainly the internet: search engines, social networks, professional profiles, public documents, community pages, registries and archives.

“Open source” here does not mean open-source software. It means the information is public — anyone can reach it without breaking into anything.

Why does it work so well for people search? Because of the digital footprint. Every person leaves traces: they sign up for a social network, create a LinkedIn account, write an article, go to a meetup, join a professional chat, leave a product review. Together, the traces show what a person does and where they can be reached.

In my course I list three reasons OSINT is convenient. It is lower risk: you work with what people have published themselves. It is cheap: most of the work needs a browser, not expensive software. And the information is easy to access and usually up to date. There is a fourth point on the same slide, and it matters as much as the first three: read the laws that apply to you.
FROM MY PRACTICE · ALFA-BANK

Without realizing it, I first used OSINT back at Alfa-Bank. In 2006, when I was looking for suitable candidates, I typed in the kind of words a marketer would use about their work — I understood that it was most likely already written somewhere on the internet, and that way I would find a mention of some marketer.

I found a bank’s staff list, I found a phone number — I used these techniques to find information. I did not know then that it was called OSINT, but I was using it.

I came closer to OSINT at iDeals, where we used these techniques actively, because recruiting is exactly the field where all of this applies. Many recruiters and sourcers do not even know that they are using them.

OSINT thinking is a guess about where in public sources the information already lies — and the skill to pull it out. Recruiters often use it long before they learn the word.

— Mike Pritula

How do recruiters and HR use OSINT?

In recruiting, OSINT covers five jobs:
  • Resume search — CVs posted on personal sites, cloud documents, portfolios and file storage.
  • Candidate search — people who are not looking for a job and will never see your vacancy.
  • Contact search — a work email or a public profile where you can write to the person.
  • Candidate research — what the person has published, spoken about and built, so the first message is about them and not a template.
  • Lists — public lists of conference speakers, event participants or community members in your field.
In my course this becomes a three-step sourcing model that anyone can learn: names (find suitable candidates on different platforms with X-ray and Boolean search), contacts (find how to reach them with plugins and services), connection (write to them and get replies).

HR and employer branding use the same methods for market analysis, competitor research — including what competitors’ employees publish about their work — and monitoring. Two simple tools from the course: Google Alerts for mentions of your company and competitors, and Visualping for changes on a competitor’s careers page.

The OSINT process: seven steps

In the course I teach the search as a procedure:
  1. Define the goal and draw up a research plan.
  2. Prepare the equipment and programs the task needs — browser, plugins, a separate work account.
  3. Search for all available identifiers: name, username, email, company domain, location.
  4. Collect the information.
  5. Analyse what you found.
  6. Prepare a conclusion — a shortlist, a market map, an answer to the hiring manager.
  7. Archive or clean up after the task.
Step one is where most searches fail. The goal is not “find a developer”. The goal is a set of hypotheses — your guesses about where the information is. A hypothesis that does not work is also a result: the circle has narrowed by one step.

For recruiting, I build hypotheses from questions like these:
  • What job titles might the candidates have?
  • Which companies do they work for now?
  • What keywords are in their profiles?
  • Which communities, groups and chats are they part of?
  • Which events do they register for?
  • What do they post online?
  • Which certifications have they completed?
Each answer is a place to search or a word for the string.
FROM MY PRACTICE · DONOR COMPANIES

Say I need a recruiter who knows the Lever recruiting system, and it is critical that they know exactly this system. I type “Lever” and find very few candidates. On LinkedIn, “Lever” gives 20,000 people — but Lever is also just an ordinary word. I add “recruiter” — 358. I filter to Ukraine — 8 people are left.

But if a company uses Lever, the whole company works in it, and every recruiter there knows the system, whether or not the word is in their profile. So I take the company name and drop the word “Lever”. It turned out the company had been renamed to Grid Dynamics, which is why the old name found nothing. Current company Grid Dynamics plus “recruiter”: 19 recruiters. Add former employees and there are 42 more — around 60 candidates, and none of them uses the word “Lever” in their profile.

Many candidates never write their key skill in the profile, so keyword search misses them. Search the companies whose employees are bound to have that skill — then the job title and the company name are enough.

— Mike Pritula

Boolean and X-ray search: the operators you need

Before the operators, one principle from my course: search for the text in the form you expect to find it. People do not describe their work the way recruiters search for it. They write in the first person, about what they did: “I built”, “we launched”, “I am responsible for”. Your string has to match the words on their page, not the words in your job description.

The operators that cover most recruiting searches:
  • "quotes" — exact phrase, no synonyms: "chief accountant".
  • OR (or |) — widens the search with synonyms: designer OR artist.
  • - (minus) — excludes a word; no space after the minus: designer -2D. Google does not understand NOT.
  • ( ) — groups parts of a long string.
  • site: — searches inside one site. This is X-ray search: site:linkedin.com/in.
  • intitle: and inurl: — the word must be in the page title or address: intitle:resume, inurl:cv.
  • filetype: (or ext:) — only files of one type: filetype:pdf resume.
  • * — a placeholder for an unknown word: senior * developer.
  • .. — a range of numbers: "present 1..6 months".
Two Google limits shape every string. A query is cut at 32 words, so long lists of synonyms simply stop working. And Google shows only about 300 results, whatever number it promises at the top. In one search for HR profiles Google announced 213,000 results; when I scrolled to the end, there were 305. The fix is to split one wide string into several narrow ones — by city, title or company.
FREE TOOL

X-ray search string builder

Choose where your candidates leave traces, fill in the job titles and skills, and copy a ready Google string. Separate synonyms with commas. The builder searches only public, indexed pages.

Words: 12 of 32
Run it in Google →

The full version — dozens of ready X-ray strings for social networks, file storage and personal sites, search hypotheses, browser plugins and contact search — is in the OSINT Course: People Search and Investigation Training.

OSINT search strings recruiters can copy

These strings come from my course. Change the job titles, companies and cities to your own.

People who joined a company recently (change the range to years if you need: 1..3 years):
site:linkedin.com/in ("at Facebook" OR intitle:Facebook) "present 1..6 months"
Current role in the page title, with language and location:
site:linkedin.com/in "Spanish native" intitle:Translator "London, United Kingdom"
Candidates open to relocation:
site:linkedin.com/in (developer OR "senior developer") ("relocation to" OR "open * relocation" OR "willing * move" OR "willing * relocate" OR "ready * relocate") -recruiter -inurl:dir
Resumes in Google Docs:
site:docs.google.com/document/ accountant intitle:resume -example -sample -template
Personal pages and profiles outside LinkedIn:
site:*.github.io intitle:resume
site:stackoverflow.com/users intitle:"java developer"
site:xing.com/profile intitle:"UX Designer" Berlin
site:meetup.com developer "member since"
Once you have a name and a company, the course goes on to contacts. The simplest legitimate route to a work email: find any published address at that company, see the pattern (firstname.lastname@, f.lastname@ and so on), build the address for your candidate and check it with an email validation tool before you write. When you have built a shortlist, the next step is comparing people fairly — I describe that in Shortlisting Candidates: the all-in-one guide.

OSINT ethics: where HR must stop

People leave far more traces than they think — that is why HR needs rules. The ethics slide in my course has five:
  1. Use OSINT according to the law and only within the legal field.
  2. Use it only to solve a task — a specific vacancy, a specific market question.
  3. Do not disclose the data you found.
  4. Do not cause harm with it.
  5. Do not use it for criminal activity or help anyone who does.
In practice, for HR and recruiters this means:
  • Stay with professional, public information. Work history, skills, published articles, talks and portfolios are fair. Private life, family, health or beliefs are not part of a hiring decision.
  • Do not touch leaked databases, hidden files or tricks that bypass a site’s protection. The fact that something can be found does not mean HR may use it.
  • Formal background checks need consent. Pre-employment checks of criminal records, credit history or references through providers are regulated in many countries. Tell the candidate, get written consent and follow your local law.
  • Keep only what you need, and delete it after the task. That is step seven of the process — archive or clean up.
  • Never show the candidate how deep you dug. Use what you learn to pick the topic of the first message; saying “I know which groups you are in” is a minus, not a plus.
One more piece of advice I give every group: test OSINT tools on yourself first. Search your own name and email. You will see how deep each tool goes — and you will feel what it is like to be on the other side of the search.

Common OSINT mistakes in recruiting

  1. Starting without hypotheses. Typing the job title into Google is not a search strategy. Decide where the people are first.
  2. Searching in recruiter language. Candidates write “I built the payment service”, not “seeking backend engineer with fintech background”.
  3. One giant string. Over 32 words Google cuts the query; over about 300 results it stops showing them. Several narrow strings beat one wide string.
  4. Only keyword search. Many strong candidates never list their key skill. Search by the companies where that skill is a given.
  5. Treating everything public as fair game. The ethics rules above are not optional.
OSINT is not a hacker skill for recruiters. It is disciplined search: a goal, hypotheses, the right operators and clear ethics. The full path — preparing your browser and plugins, Boolean and X-ray search across social networks and file storage, people search, contact search and the tools for each step — is in my OSINT Course: People Search and Investigation Training.
FAQ

Frequently asked questions

What does OSINT stand for?

OSINT stands for open source intelligence: collecting and analysing information from publicly available sources. “Open source” here means public, not open-source software.

Is OSINT legal for recruiters?

Searching public, indexed information is legal in most places, but how you store and use personal data is regulated. Use OSINT only for a specific hiring task, keep only what you need, and run formal background checks only with the candidate’s consent and under your local law.

What is the difference between OSINT and sourcing?

Sourcing is finding candidates and their contacts. OSINT is the wider discipline of finding any information in public sources — people, documents, companies, facts. Sourcing is the part of OSINT that recruiters use every day.

What is X-ray search?

X-ray search uses the site: operator in Google to search inside one website, for example site:linkedin.com/in for public profiles. It gets around the limits of a site’s own search and works without a paid account.

Which OSINT skills should a recruiter learn first?

Start with search hypotheses — where your candidates leave traces — then Boolean operators, X-ray search and file search. Contact search tools and browser plugins come after that.