external reconnaissance osint assessment

The problem

Mapping a digital footprint manually is slow and prone to overlooking exposed assets. Security teams often struggle to convert raw OSINT data into actionable risk registers that meet governance and defensive standards.

What it does

• Generates structured external reconnaissance reports based on authorized domain or brand scopes.
• Logs source provenance for DNS records, certificates, public repositories, and cloud storage findings.
• Categorizes exposures by confidence levels and maps them to risk rationales.
• Produces remediation plans for leaked secrets, weak email security, and unmanaged internet-facing assets.
• Sanitizes output by identifying sensitive exposure indicators without disclosing raw credentials or PII.

Frameworks & tools

Supports data exports from Shodan, Censys, SecurityTrails, VirusTotal, and GitHub. Includes Python helpers for exposure registration and Shodan API enrichment.

Why this beats prompting it yourself

Writing prompts for OSINT often results in "hallucinated" vulnerabilities or dangerous exploit suggestions. This skill enforces strict defensive boundaries, ensuring reports remain focused on governance and remediation rather than unauthorized offensive tactics.

Use cases

• Pre-penetration testing reconnaissance to define and validate assessment scope.
• M&A due diligence to identify the digital liabilities of a target organization.
• Continuous attack surface monitoring for leaked secrets and exposed cloud buckets.
• Supplier security assessments to verify the external posture of third-party partners.

Known limitations

Does not perform active scanning or brute forcing. Requires manual input of tool exports or API keys for automated collection scripts.