Open Source Intelligence Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Intelligence Analysts, Law Enforcement Investigators and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-SLE-008

Before you join: Participants should have experience handling investigations, security incidents, compliance enquiries, intelligence requests or risk assessments.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Open source intelligence supports decisions where information is publicly available but dispersed, inconsistent, rapidly changing or difficult to verify. Security, law-enforcement, regulatory and public-sector teams may need to identify actors, assess threats, verify incidents, trace corporate connections, monitor online narratives or establish the location and timing of events. Poorly managed collection can create legal, ethical, security and evidential risks, while untested findings can misdirect operational decisions.

This course teaches a disciplined OSINT process from intelligence requirements through collection, validation, analysis and reporting. Participants learn to build search strategies using Boolean logic and advanced search operators; research people, companies and online communities; assess social-media content; geolocate images and videos; preserve digital material; and test competing explanations. The course applies the Intelligence Cycle, Admiralty Code source grading and Analysis of Competing Hypotheses to produce findings that decision-makers can understand, challenge and act upon.

Instructor-led sessions combine short briefings with guided case work, research simulations, group analysis and report-writing practice. Cases reflect realistic public-sector security, fraud, safeguarding, regulatory and investigative scenarios. Participants leave with a reusable OSINT case file containing an intelligence requirement, collection plan, source record, assessment log, analytical product and reporting structure. The course is available in classrooms in more than 50 cities or live online, runs for five days, and includes a certificate of completion.

The course is suited to professionals who already handle investigations, security assessments, compliance enquiries, intelligence products or incident response and need a repeatable method for gathering and assessing publicly available information.

What you will be able to do

  • Define priority intelligence requirements, indicators and collection boundaries for an OSINT task
  • Apply legality, necessity, proportionality and data-protection controls to public-source collection
  • Construct Boolean and advanced search queries for targeted web research
  • Conduct entity research across public records, corporate registries and social platforms
  • Geolocate visual material using imagery, map layers, landmarks and environmental indicators
  • Preserve online material using source records, screenshots, hashes and chain-of-custody logs
  • Assess source reliability, information credibility and competing hypotheses using structured analysis
  • Produce a decision-focused intelligence report with confidence statements and cited sources

Benefits of attending

For you

  • Build defensible OSINT findings rather than relying on unstructured internet searching
  • Research people, organisations and online activity with clearer legal and ethical boundaries
  • Identify manipulated, outdated or weakly sourced online material before reporting it
  • Create intelligence products with clearer confidence levels, caveats and source citations
  • Develop a repeatable research workflow for investigations, risk assessments and incident enquiries

For your organisation

  • Improve consistency of public-source research across investigative and security teams
  • Reduce legal, privacy and reputational exposure from poorly controlled online collection
  • Produce auditable source records that support review, disclosure and quality assurance
  • Increase speed in identifying relevant entities, networks, locations and emerging risks
  • Strengthen decision briefs through tested assessments rather than unsupported online claims

Course modules

10 modules over 5 days

Participants can define an OSINT requirement and produce a controlled collection plan.

  • Intelligence cycle stages from direction through dissemination and feedback
  • Requirements questions converted into collection priorities, indicators and decision deadlines
  • Source, information and intelligence distinguished using operational examples
  • Collection plans matched to legal authority, risk and proportionality
  • Priority intelligence requirements framed with 5W1H and named decision owners
  • Tasking records document purpose, scope, dates and collection constraints
  • Collection priorities reviewed against changing operational questions and emerging findings

Participants can assess whether proposed OSINT collection is lawful, necessary and proportionate.

  • Applicable privacy, data protection and human-rights principles for OSINT collection
  • Lawful basis, necessity and proportionality tested before collecting personal data
  • Terms of service, platform rules and acceptable-use restrictions assessed
  • Separate public availability from permission to collect, retain or share
  • Handling procedures protect sensitive personal data, minors and vulnerable persons
  • Ethical decision log records intrusion, harm, bias and mitigation
  • Disclosure boundaries distinguish intelligence support from evidential investigation

Participants can protect researchers, accounts, devices and collected material during OSINT work.

  • Threat modelling identifies adversaries, exposure, consequences and protective controls
  • Operational security measures separate research identities from personal accounts
  • Research personas documented with purpose, limitations and approval status
  • Browser isolation, virtual machines and password managers reduce exposure
  • Metadata hygiene prevents accidental disclosure through downloads, screenshots and documents
  • Escalation triggers cover threats, distressing content, doxxing and illegal material
  • Secure evidence storage applies access controls, encryption and retention schedules

Participants can conduct targeted web searches and validate relevant online sources.

  • Boolean operators construct precise queries across search engines and databases
  • Google dorks locate exposed documents, directories, filetypes and indexed records
  • Site, filetype, intitle and inurl operators refine search scope
  • Search results validated through source provenance, dates and independent corroboration
  • Advanced queries retrieve historical publications, procurement notices and official registers
  • Web archives recover changed pages using capture dates and URL checks
  • Search logs preserve query syntax, result URLs and collection timestamps

Participants can research entities and map relationships using public records and identifiers.

  • Entity resolution separates namesakes using identifiers, addresses and relationship clues
  • People searches combine official records, professional profiles and media references
  • Corporate registries reveal directors, beneficial ownership, filings and dissolved entities
  • Sanctions, watchlists and procurement databases tested for identity matches
  • Chronologies reconcile events, appointments, transactions and public statements
  • Link charts map associates, organisations, locations and shared identifiers
  • Confidence labels distinguish confirmed facts, assessed links and unverified leads

Participants can assess social-media content, accounts and interaction patterns without overclaiming.

  • Platform-specific search syntax locates posts, profiles, groups and engagement patterns
  • Usernames correlated across platforms without assuming common account ownership
  • Social graph analysis identifies central accounts, clusters and interaction pathways
  • Content timelines reveal behavioural changes, mobilisation signals and narrative shifts
  • Deleted-post recovery uses archives, cached results and contemporaneous reporting
  • Bot and coordinated-behaviour indicators assessed without automated attribution claims
  • Platform evidence captured with URLs, timestamps, context and preservation notes

Participants can assess visual material and state a supported location or timing judgement.

  • Visual geolocation applies signage, architecture, terrain and road-marking indicators
  • Reverse image search identifies prior appearances, altered images and source copies
  • Sun, shadows and weather patterns support time and location assessment
  • EXIF metadata extraction checked against editing history and device limitations
  • Satellite imagery compares buildings, routes, landmarks and damage indicators
  • Map layers test proximity, access routes, boundaries and administrative names
  • Geolocation conclusions state confidence, alternatives and corroborating evidence

Participants can preserve online material with traceable records suitable for review and disclosure.

  • Collection records capture source URL, access time, collector and method
  • Chain-of-custody logs document acquisition, handling, storage and transfer events
  • Hashes verify file integrity after collection and during disclosure
  • Screenshot protocols preserve full context, browser address and timestamps
  • Structured data extraction normalises dates, names, locations and identifiers
  • CSV cleaning resolves duplicates, formats fields and flags missing values
  • Retention schedules align data minimisation, review periods and disposal actions

Participants can test evidence, assess confidence and identify priority intelligence gaps.

  • Admiralty Code grades source reliability and information credibility separately
  • Analysis of Competing Hypotheses tests explanations against available evidence
  • Timeline analysis identifies gaps, contradictions, sequences and turning points
  • Link analysis distinguishes direct connections, inferred associations and unknown relationships
  • Confidence statements separate observations, inferences, assumptions and intelligence gaps
  • Alternative hypotheses reduce confirmation bias and premature closure
  • Collection gaps translated into targeted follow-up requirements and priorities

Participants can communicate OSINT findings clearly and plan controlled application in their role.

  • Intelligence reports answer decision questions before presenting collection detail
  • Key judgements use calibrated language, confidence levels and explicit caveats
  • Source citations enable review, reproducibility and lawful disclosure decisions
  • Briefing structures distinguish facts, assessments, risks and recommended actions
  • Visual products apply link charts, timelines and annotated maps appropriately
  • Peer review checks relevance, accuracy, bias, security and legal compliance
  • Personal application plans define priority cases, controls and first actions

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. OSINT intelligence requirement template
  2. Legality and proportionality decision log
  3. Public-source collection plan
  4. Digital evidence capture checklist
  5. Source reliability and confidence assessment model
  6. Decision-focused intelligence report template

Who should attend

  • Intelligence Analysts — need defensible methods for converting public information into assessed intelligence
  • Law Enforcement Investigators — need to develop leads while preserving legal and evidential discipline
  • Security and Risk Officers — need to assess threats, persons and incidents from public sources
  • Fraud and Financial Crime Teams — need to research entities, networks and adverse information
  • Compliance and Due Diligence Professionals — need to verify ownership, reputation and exposure indicators
  • Public Sector Investigators — need documented collection methods for regulatory, safeguarding or enforcement cases

Skills and tools covered

OSINT collection planningAdvanced web researchDigital evidence preservationSocial media assessmentGeolocation analysisIntelligence reporting

Tools and standards

Internet Archive Wayback Machine, Google Search operators, Admiralty Code, Analysis of Competing Hypotheses (ACH)

How the course runs

Training methodology

The course uses short instructor briefings to establish methods, legal controls and analytical standards, followed by realistic case work using publicly accessible material. Participants practise search construction, entity research, social-media assessment, geolocation, evidence capture and structured analysis in small groups. Simulations require teams to turn a decision question into a documented collection plan and assessed briefing. Facilitated peer review focuses on source quality, confidence, bias, handling controls and report clarity. Each participant finishes with an application plan for their own work context.

Requirements and prerequisites

Participants should have experience handling investigations, security incidents, compliance enquiries, intelligence requests or risk assessments. They should be comfortable using web browsers, search engines, spreadsheets and common office software. Familiarity with basic report writing and the distinction between fact and assessment is helpful. No programming, cyber-security certification, forensic qualification or prior OSINT course is required. The course does not require participants to create covert identities, access restricted systems or use intrusive collection methods.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should be comfortable using web browsers, search engines and office software, and have some exposure to investigations, security, compliance or risk work. No programming, cyber-security qualification or previous OSINT training is required.

Bring a laptop that can access the internet and common office applications, plus any approved internal policies relevant to your role. Do not bring live case material, personal data or restricted information unless your organisation has formally authorised its use.

It is designed for analysts, investigators, security staff, fraud teams, compliance professionals and public-sector officers who need to assess publicly available information. It is particularly useful for people who already produce reports or briefings for operational decisions.

This course focuses on lawful collection and assessment of publicly accessible information. Digital forensics examines devices and data acquired through authorised investigative processes, while cyber threat intelligence focuses more specifically on technical threats, indicators and adversary activity.

The methods apply to due diligence, safeguarding enquiries, incident verification, fraud enquiries, threat assessment, regulatory work and investigations. Participants can adapt the collection plan, source record and reporting templates to their approval processes and case types.

The course provides approximately 32.5 contact hours from 08:30 to 16:30 each day. Time is divided between instructor briefings, guided research, case analysis, simulations, peer review and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Security & Law Enforcement