A professional open-source intelligence investigation is a structured process for answering a defined question using publicly available or lawfully accessible information.
It is not an unrestricted search for everything that can be found about a person, company, vessel or event. Nor is it a sequence of database checks followed by a collection of screenshots.
A properly conducted OSINT investigation moves through five connected stages:
Each stage affects the reliability of the next. Poor scoping produces irrelevant collection. Weak collection creates evidential gaps. Inadequate verification allows false information into the analysis. Unsupported analysis leads to conclusions that cannot withstand scrutiny.
The process must also be documented throughout. An investigation should leave a clear trail showing where information came from, how it was assessed and why particular conclusions were reached.
1. Scope the intelligence requirement
Every investigation should begin with the decision it is intended to support.
A request such as “investigate this company” is too broad. It does not define what matters, how far the research should go or what would constitute a useful answer.
A stronger intelligence requirement might ask:
These questions give the investigation direction. They determine which subjects, jurisdictions, time periods and sources are relevant.
Start with the decision
The same subject may need to be investigated differently depending on the decision.
An investor considering an acquisition may need to understand ownership, management history, litigation, regulatory exposure and undisclosed commercial relationships.
A legal team preparing a claim may need a documented timeline, evidence preservation and a clear distinction between verified facts and potential leads.
A maritime operator assessing sanctions exposure may need to examine registered ownership, beneficial control, management, flag history, port activity and vessel movements.
The subject may be identical, but the intelligence requirement changes the collection plan and reporting standard.
Define the subjects precisely
Before collection begins, the investigator should identify exactly who or what is being examined.
A company may operate under a trading name that differs from its registered legal name. A corporate group may include several similarly named entities. A vessel may have changed its name, flag, owner or manager. An individual may use several spellings or transliterations of the same name.
Useful identifiers can include:
The purpose is to reduce the risk of confusing one subject with another.
Establish the relevant timeframe
An investigation should specify the period under review.
Current records may not explain who controlled a company three years earlier. A vessel’s present owner may not have been responsible for its activity during the relevant voyage. A director may have resigned before a disputed transaction occurred.
Historical research is often essential. The investigator may need to reconstruct:
Without a defined timeframe, current information can easily be applied incorrectly to past events.
Set legal and ethical boundaries
Scoping should identify whether the investigation involves personal data, sensitive allegations, vulnerable individuals or information that could create a safety risk.
The team should consider:
Professional OSINT does not involve hacking, unlawful access, credential theft, pretexting or impersonation.
Information should not be collected simply because it is accessible. It should be relevant and proportionate to the intelligence requirement.
Agree the expected output
The final deliverable should be defined before collection starts.
Depending on the matter, the client may require:
The required level of detail influences the time, sources and review procedures needed.
A report intended for an internal commercial decision will not necessarily require the same evidential treatment as work expected to support litigation or regulatory engagement.
Define completion criteria
Open-source research can continue indefinitely if there is no clear stopping point.
Completion criteria help determine when the intelligence requirement has been addressed to a reasonable and proportionate standard.
They might include:
Completion does not always mean that every question has been answered. It can mean that the limits of available evidence have been reached and documented.
2. Build the investigation plan
Once the intelligence requirement is clear, the investigator develops a plan for answering it.
This plan translates the main question into smaller investigative questions, identifies likely sources and establishes an efficient order of work.
Break the requirement into questions
A beneficial ownership investigation might be divided into the following questions:
This prevents the investigation from becoming a series of disconnected searches.
Form preliminary hypotheses
Investigators may develop several possible explanations to test.
For example:
Hypotheses are not conclusions. They provide a disciplined way to look for supporting and contradictory evidence.
A strong investigation does not search only for information that confirms the initial suspicion. It actively considers alternatives.
Prioritise the strongest identifiers
Collection should usually begin with identifiers least likely to be ambiguous.
A company registration number is generally more reliable than a trading name. A vessel’s IMO number is more stable than its current name. A date of birth can help distinguish between people who share a name.
Starting with strong identifiers makes later searches more precise and reduces false matches.
Create a source map
The investigator identifies which source categories are likely to answer each question.
For a corporate investigation, the source map may include:
For a maritime investigation, it may also include:
The source map should account for jurisdictional differences. Records that are readily available in one country may be restricted, delayed or incomplete in another.
Set collection priorities
Not all sources should be searched with equal urgency.
A sensible order is often:
Beginning with primary records gives later information a reliable framework.
3. Collect relevant information
Collection is the process of locating and preserving information that can help answer the intelligence requirement.
The aim is not to gather the largest possible quantity of data. It is to collect information that is relevant, reliable and proportionate.
Work from sources, not just search results
Search engines are useful discovery tools, but they do not provide a complete or neutral view of available information.
Results can be shaped by geography, language, personalisation, popularity and search-engine indexing. Important records may not appear in ordinary searches.
Professional collection often requires direct searches of registries, court systems, archives, regulatory databases and specialist platforms.
Collect the underlying record
Where possible, the investigator should obtain the original document or record rather than relying on a summary.
For example:
Underlying records provide context that summaries may omit.
Search across languages and jurisdictions
International investigations may require research using local languages, scripts and naming conventions.
A person’s name may appear differently across corporate records, media reporting and sanctions notices. A company may use translated and untranslated versions of its name. Legal forms and address structures also vary between jurisdictions.
Investigators may need to search:
Machine translation can assist discovery, but material findings should be reviewed carefully. Legal, corporate and technical terminology can be mistranslated or stripped of important context.
Follow connections methodically
Findings often create new lines of enquiry.
A director may lead to another company. An address may reveal a cluster of entities. A domain may connect to an email address or technical service. A vessel manager may be linked to a broader ownership network.
These connections should be followed in a controlled way.
Each new subject should be assessed against the intelligence requirement:
Without this discipline, an investigation can expand into a large network of weak and irrelevant associations.
Record negative findings carefully
An unsuccessful search can still be relevant, but it must be described accurately.
There is an important difference between:
Investigators should avoid treating an absence of evidence as evidence of absence.
Preserve the evidence
Online information can change or disappear. Relevant evidence should therefore be preserved in a way that allows later review.
An evidence record may include:
Preservation is particularly important when material may support legal proceedings, regulatory engagement or a serious allegation.
Maintain an investigation log
An investigation log records what was searched, when it was searched and what resulted.
This helps the team:
A log also helps establish that conclusions were reached through a consistent process rather than selected after the event.
4. Manage information during the investigation
Collection can quickly produce hundreds of records, screenshots, names and potential connections.
Without a structured system, important evidence may be overlooked, duplicated or separated from its context.
Separate subjects and entities
Each person, company, vessel, address or domain should have a consistent identifier in the working material.
This reduces confusion when names are similar or change over time.
For example, a company record might include:
Structured entity records make comparisons easier and reduce the risk of combining unrelated subjects.
Build timelines as collection progresses
A timeline helps expose gaps, contradictions and patterns that may be difficult to see in isolated records.
Relevant events might include:
Dates should reflect what the source actually establishes. The date a record was published may differ from the date an event occurred.
Maintain a claim ledger
A claim ledger is a structured list of assertions being examined.
Each claim can be marked as:
The ledger should identify the sources supporting or challenging each claim.
This is particularly useful in investigations involving adverse allegations, breaking news or disputed corporate histories.
Record contradictions rather than resolving them prematurely
When two sources disagree, both should be retained until the reason for the discrepancy is understood.
Possible explanations include:
Contradictions often reveal where additional collection is most valuable.
Protect sensitive information
Investigation files may contain personal data, confidential instructions and allegations that have not been verified.
Access should be limited to those who need the information. Storage, transmission, retention and deletion should follow appropriate security and data-protection procedures.
Working notes should not be treated as publication-ready findings. They may contain tentative connections, rejected hypotheses and unverified leads.
5. Verify the evidence
Verification determines whether the collected information is authentic, correctly attributed and suitable for use in the analysis.
A source may appear credible while containing inaccurate, incomplete or misleading information. Even an authentic record may concern the wrong person, company, vessel or event.
Verification should therefore address four separate questions:
These questions should be answered before the information is relied upon in a finding.
Verify the source
The investigator should establish where the information originated and how it reached the current source.
For documents and records, this may involve checking:
For online content, it may involve identifying:
A screenshot on its own is usually weaker than the underlying page, record or post. Screenshots can omit dates, account details, surrounding text and later corrections.
Verify the subject
Information must be attributed to the correct person or entity.
A matching name is not enough. Identity should be tested using a combination of identifiers, such as:
The seriousness of the finding should determine the required level of assurance.
A possible match may be sufficient to generate a lead. It is not sufficient to attribute misconduct, sanctions exposure or another material risk to a named subject.
Verify the date and context
Authentic information can still be misleading when removed from its original time or context.
Investigators should distinguish between:
This distinction matters in historical investigations.
A current corporate record may not show who controlled the company during an earlier transaction. A recently published article may describe events that occurred several years ago. A vessel may have changed owner after the activity under review.
The investigator should also determine whether the source describes a fact, allegation, opinion, estimate or legal finding.
Verify images and video
Visual material requires more than a judgement about whether it looks genuine.
Verification may include:
Successful geolocation does not automatically confirm the stated date. Confirming the date does not automatically establish who recorded the material or why.
Each element should be assessed separately.
Verify corporate and ownership information
Corporate records can appear definitive, but their reliability depends on the jurisdiction and the nature of the filing.
Investigators should consider:
Formal ownership and effective control are not always the same.
A person may exercise control through contractual rights, management authority, family relationships, financing arrangements or an intermediary. Any assessment of effective control should be clearly distinguished from registered ownership.
Corroborate material findings
Important findings should be tested against independent evidence wherever possible.
Independence matters more than quantity. Several databases may all rely on the same original registry. Numerous news articles may repeat one initial report.
The investigator should determine whether apparently separate sources have genuinely different origins.
Strong corroboration often combines records created for different purposes. For example:
Together, these sources may support a stronger conclusion than any one record alone.
Evaluate source reliability
Source assessment should consider:
No source type should be given automatic authority.
An official record may contain inaccurate information supplied by the subject. A news report may be based on confidential but well-placed sources. A social media post may provide direct evidence of an event while presenting a misleading interpretation.
The investigator must assess what the particular source can support.
Handle contradictory evidence
When reliable sources disagree, the contradiction should become part of the investigation.
The investigator may need to ask:
A contradiction should not be resolved simply by selecting the source that supports the preferred hypothesis.
If it cannot be resolved, the final report should explain the disagreement and its effect on confidence.
6. Analyse what the evidence means
Analysis turns verified information into an answer to the intelligence requirement.
This stage requires judgement. The investigator must determine which findings are material, how they relate to one another and what reasonable conclusions they support.
Analysis should not begin only after collection has finished. Preliminary analysis helps direct further research throughout the investigation. However, final conclusions should be delayed until the relevant evidence and competing explanations have been considered.
Organise findings around the question
Evidence should be grouped according to the intelligence requirement rather than the order in which it was found.
For a counterparty investigation, the analytical structure might include:
This structure helps the analyst see where the evidence is strong and where gaps remain.
Distinguish facts from assessments
A professional analysis should separate:
For example:
Verified fact: Three companies shared directors and a registered address during the period under review.
Analytical inference: The companies may have been part of the same administrative or commercial network.
Assessment: The shared directors and address, combined with common contact details, coordinated ownership changes and evidence of joint operations, support the assessment that the companies were under common influence.
The language should reflect the strength of the evidence. A possible connection should not be described as control unless the evidence supports that conclusion.
Test competing hypotheses
Analysis should examine more than one plausible explanation.
Suppose several companies share an address. Possible explanations might include:
Further evidence can then be collected to test each possibility.
This approach reduces confirmation bias and helps prevent suspicious indicators from being treated as proof.
Assess materiality
Not every verified fact belongs in the final report.
Materiality depends on the question and the decision.
An old directorship may be irrelevant to a routine supplier assessment but highly significant if it connects the subject to an undisclosed business involved in the matter under investigation.
The analyst should ask:
Information that does not help answer the intelligence requirement may be excluded from the main findings.
Analyse networks carefully
Network analysis can reveal connections between people, companies, addresses, domains, vessels and events.
However, a visible connection is not automatically a meaningful relationship.
Investigators should distinguish between:
A complex diagram can create an impression of significance that the evidence does not support. Every important connection should be traceable to a source and accompanied by an explanation of what it means.
Reconstruct timelines
Timelines help establish sequence, responsibility and possible causation.
An investigator may compare:
Sequence does not prove causation, but it can reveal relationships that require further investigation.
If a company changes ownership shortly before a major transaction, the timing may be relevant. It does not, on its own, establish that the change was designed to conceal control.
Identify information gaps
A useful investigation explains what could not be established and why.
Common gaps include:
Information gaps should be linked to their potential effect on the assessment.
Some gaps may be minor. Others may prevent a confident conclusion.
Assess confidence
Confidence should reflect:
A simple framework can use high, moderate and low confidence.
High confidence
The conclusion is supported by several reliable and independent sources. Material contradictions have been resolved, and alternative explanations are unlikely.
Moderate confidence
The conclusion is supported by credible evidence, but important gaps or reasonable alternatives remain.
Low confidence
The conclusion relies on limited, indirect or difficult-to-verify information. Significant uncertainty remains.
Confidence is not the same as probability, and it does not describe how strongly an analyst feels. It describes the quality of the evidential foundation.
Consider what would change the assessment
A strong analytical process asks what new information could alter the conclusion.
For example:
This helps the reader understand both the strength and the limits of the current assessment.
7. Report the findings
The report should answer the intelligence requirement directly and allow the reader to understand how the conclusion was reached.
It should not force the client to interpret a large collection of records, screenshots and database entries.
The investigator’s role is to identify what matters, explain the evidence and communicate uncertainty accurately.
Executive summary
The executive summary should present:
It should be written for a decision-maker who may not read the full report.
The summary should not introduce conclusions that are unsupported by the detailed findings.
Scope and limitations
The report should define:
Clear scope prevents the findings from being applied more broadly than the investigation supports.
For example, a search of public records in three jurisdictions cannot establish that no assets exist anywhere else.
Methodology
The methodology section should explain how the investigation was conducted.
It may cover:
The explanation should be sufficient for the work to be reviewed without disclosing unnecessary operational detail or personal data.
Detailed findings
Findings should be organised by question or theme.
Each significant finding should make clear:
The most important information should not be buried beneath background detail.
Visual material
Timelines, ownership charts and network diagrams can make complex findings easier to understand.
Any visual should:
A diagram should clarify the evidence, not make the investigation appear more conclusive than it is.
Implications and next steps
A decision-grade report explains what the findings mean.
Possible implications might include:
Recommendations should be proportionate and connected to identified risks or gaps.
Quality assurance
Before delivery, the investigation should be reviewed for:
Where possible, a second investigator should review material findings and attempt to challenge the principal conclusions.
Quality assurance is not a cosmetic editing stage. It is part of the investigative process.
What happens after delivery?
An investigation may identify new questions or records that require further work.
After delivery, the client may decide to:
The report should provide a clear basis for making that decision.
Frequently asked questions
How long does an OSINT investigation take?
The timeframe depends on the number of subjects, jurisdictions, languages, source availability and required level of assurance.
A focused verification may take a short period. A cross-border ownership or corporate network investigation may require considerably more time.
The work should be scoped before a realistic timeframe is agreed.
How much information is needed to begin?
An investigation can often begin with limited information, but strong identifiers improve accuracy.
Useful starting details may include:
The most important starting point is a clear question.
What if the client does not know the exact question?
The investigator should help convert the concern into a defined intelligence requirement.
For example, “we do not trust this supplier” might become:
Clarifying the question is part of the investigative process.
Can an investigation guarantee a complete answer?
No investigation can guarantee that every relevant fact will be available through open sources.
Records may be incomplete, private, outdated or unavailable in the relevant jurisdiction.
A professional report should state what was searched, what was established and which gaps remain.
Is one source enough to support a finding?
It depends on the source and the consequence of the finding.
A single authoritative record may establish a straightforward fact, such as a registered company number. Material allegations, ownership assessments and identity matches usually require stronger corroboration.
The evidential standard should increase with the seriousness of the conclusion.
What is the difference between screening and investigation?
Screening compares a subject against selected datasets or risk indicators.
An investigation follows evidence across sources, jurisdictions and time periods to answer a specific question.
Screening may identify a possible match. Investigation determines whether the match is correct, material and supported by the wider evidence.
Can OSINT establish beneficial ownership?
Sometimes.
Public filings may provide clear ownership information. In more complex cases, the investigator may need to examine corporate layers, historical changes, management relationships and indicators of effective control.
Where the evidence does not support a definitive conclusion, the report should explain the most likely assessment and its limitations.
How are false positives avoided?
False positives are reduced through identity resolution, source verification and corroboration.
Investigators should use several identifiers rather than relying on a name alone. Potential matches should be tested against dates, locations, professional history, associated entities and other distinguishing information.
What happens if sources contradict one another?
The contradiction should be investigated and documented.
The investigator may determine that one source is outdated, inaccurate or referring to another entity. If the conflict cannot be resolved, it should remain visible in the report and affect the level of confidence.
Can OSINT findings be used in legal proceedings?
Open-source findings may support legal strategy or evidential development, depending on their relevance, provenance, preservation and the applicable rules.
Investigations expected to support proceedings should apply appropriate evidence-handling and documentation standards from the outset.
Will the subject know they are being investigated?
OSINT research is generally conducted using publicly available or lawfully accessible sources without contacting the subject.
However, some matters may require a right of reply, a direct request for information or another form of engagement. This should be considered during scoping and legal review.
What should a professional investigation report include?
It should normally include:
The precise format should reflect the client’s decision and intended use.
How do you know when an investigation is complete?
An investigation is complete when the agreed intelligence requirement and completion criteria have been addressed to a reasonable and proportionate standard.
This does not necessarily mean that every question has been answered. It may mean that the limits of the available evidence have been identified and further open-source collection is unlikely to change the principal assessment.
Commission an OSINT investigation
A reliable investigation starts with a precise question and ends with findings that can be understood, reviewed and acted upon.
Greywing Intelligence conducts structured open-source investigations for corporate, legal, risk and maritime clients. We define the intelligence requirement, test the evidence, assess competing explanations and report our conclusions with clear confidence levels and limitations.
If you need to investigate a counterparty, trace ownership, verify an allegation, understand a corporate network or assess a maritime risk, we can help define the right scope and investigative approach.
Contact Greywing Intelligence to discuss the question you need answered.