When we run a threat assessment for a high-profile client, the first phase rarely involves touching a single device. It involves reading. Almost everything an adversary needs to plan a targeted operation has already been published — by companies, by registries, by staff, and by the client themselves.

Open-source intelligence, or OSINT, is the practice of assembling a picture of a target from publicly available information. It is not exotic and it is not illegal. It is the reconnaissance phase of nearly every serious attack we investigate, and it is the phase where defence is cheapest.

What an adversary can build in an afternoon

A competent researcher working from nothing but a name can typically establish the following within a few hours, at no cost:

  • Current and former employers, board seats, and directorships from corporate registries
  • Residential addresses through property records, electoral rolls, and past filings
  • Family members, their employers, and their schools through social platforms
  • Travel patterns from geotagged photographs, event listings, and speaking engagements
  • Email address conventions, inferred from a single leaked colleague address
  • Personal device and software preferences from support forum posts and product reviews

None of these facts is dangerous in isolation. The danger is in the assembly. An address plus a travel window plus a household staff roster is an operational plan. An email convention plus a school name plus a plausible pretext is a spear-phishing message that will be opened.

The goal of footprint reduction is not invisibility. It is to make assembly expensive enough that your profile is no longer worth the effort relative to the next target.

The four highest-yield reductions

1. Break the address chain

Property held in a personal name creates a permanent, indexed, publicly searchable link between an individual and a physical location. Where jurisdiction allows, holding property through an appropriate legal structure severs that link at the source. Data brokers that have already scraped the record must then be handled separately — each has a removal process, and each needs to be re-checked on a schedule, because records are frequently re-listed after acquisitions.

2. Audit the people around you, not just yourself

The most disciplined principal in the world is undermined by an assistant who posts a photograph of a boarding pass, or a family member whose account is public and geotagged. In most engagements, the largest single reduction in exposure comes from bringing associated personnel into the same standard as the principal — not from tightening the principal's own accounts further.

3. Retire the reused identifier

A personal email address or username that has been in circulation for a decade appears in dozens of breach corpora. Those corpora are indexed and searchable. Adversaries use them to confirm which services you hold accounts with, which is the map they need to plan credential attacks and account-recovery abuse. Migrating high-value accounts to fresh, unpublished identifiers — and using distinct aliases per service — removes that map.

4. Control the schedule, not just the content

Publishing a photograph after an event rather than during it costs nothing and removes real-time location disclosure, which is the component with actual operational value. The same applies to announcements of travel, attendance, and departures. Discipline about when information is published is often more effective than restraint about what is published.

Treat reduction as maintenance, not a project

Footprint reduction is not a one-time cleanup. Records are re-published, brokers re-acquire data, new filings appear, and staff turn over. We treat OSINT exposure as a monitored surface with a review cycle, in the same way we treat a firewall ruleset. A profile that was clean eighteen months ago is generally not clean today.

If you have never had your public exposure formally mapped, that is the single most useful place to start — before any hardware, any software, and any subscription. You cannot reduce a surface you have not measured.