Article Details

The Emerging Role of AI in Open-Source Intelligence. Recently the Office of the Director of National Intelligence (ODNI) unveiled a new strategy for open-source intelligence (OSINT) and referred to OSINT as the "INT of first resort". Public and private sector organizations are realizing the value that the discipline can provide but are also finding that the exponential growth of digital data in recent years has overwhelmed many traditional OSINT methods. Thankfully, Artificial Intelligence (AI) and Machine Learning (ML) are starting to provide a transformative impact on the future of information gathering and analysis. What is Open-Source Intelligence (OSINT)? Open-Source Intelligence refers to the collection and analysis of information from publicly available sources. These sources can include traditional media, social media platforms, academic publications, government reports, and any other data that is openly accessible. The key characteristic of OSINT is that it does not involve covert or clandestine methods of information gathering such as human intelligence or social engineering. If I could have obtained data during my time working for the U.S. Government but I no longer can as a civilian, that isn't OSINT. Historically, OSINT has been a labor-intensive process involving several key steps: While effective, this approach faces limitations with the sheer volume of information available. Human analysts struggle to process everything manually and valuable insights may be hidden in complex patterns that are difficult for humans to detect. This is where AI/ML can provide a tremendous benefit in how information can be collected, processed and analyzed, thus freeing the human analyst to focus on things they are uniquely qualified for such as providing context. As a side benefit, this shift often improves morale as humans spend less time on mundane processing tasks and more time analyzing and reviewing information. Tasks where AI/ML can provide immediate benefit include: At SANS Network Security the SEC497 Practical OSINT course and the SEC587 Advanced OSINT course will provide students with hands-on experience utilizing these AI capabilities to not only provide an increase in productivity, but also discover new possibilities. While no technology is perfect, and we must consider the potential ramifications that a hallucination could cause before we implement AI, key pieces of technology currently being utilized for OSINT include: I've been doing OSINT for almost two decades and this is by far the most dynamic, and exciting time I've seen with new developments in the space literally occurring daily. If you're going to be at Network Security in Las Vegas this September, I look forward to discussing how this capability can improve our effectiveness and efficiency today, as well as what we can expect in the future. Not yet registered for SANS Network Security? Check out this page to see all that's in store! Note: This article is expertly written by Matt Edmondson, a SANS Principal Instructor and Principal at Argelius Labs, with a decade of professional OSINT experience. Continuous Attack Surface Discovery & Penetration Testing Continuously discover, prioritize, & mitigate exposures with evidence-backed ASM, Pentesting, and Red Teaming.