OSINT for Business: How to Research Customers, Prospects and Markets

OSINT is the cheapest way to stop making gut calls about your customers, prospects and competitors. Every week, one of your salespeople joins a call knowing nothing about the client beyond a name and an industry. Your marketing lead picks the message for the next campaign based on a hunch. And you sign off on spending in a niche nobody has ever sized. All of that information already exists. It’s public, and it’s legal to use. What’s missing is a method inside the company for collecting it and turning it into decisions. That method exists, and you can repeat it. It has five phases you can run, a set of Italian sources to start from, and prompts that use AI to speed up the work while you still do the thinking.

What OSINT means for a business (and what it doesn’t)

Open Source Intelligence is the collection and analysis of public-interest data and news from open sources anyone can access, with the goal of drawing conclusions that support a decision. The discipline was born in security agencies during the Second World War. Private companies use it today for a far more down-to-earth reason: they want to base commercial choices on hard data ¹. What separates good practice from bad is why you collect the data and what you do with it ².

Let’s get the boundaries straight, because this is where a lot of what’s written on the topic muddies the water. OSINT has nothing to do with hacking, breaking into closed systems or leaking confidential data. A good practitioner searches, filters, verifies and connects public information without ever entering a protected system or breaking the law ². The sources have to be legally accessible to the public, with no copyright or privacy violations. That’s exactly why an ordinary company can use OSINT, and not just a private investigation firm ³.

It also works differently from the one-off market research you buy from an outside firm. OSINT is an ongoing, in-house process. It runs every week inside your company and keeps itself current as the market moves.

Fair game: company registry filings, published accounts, public reviews, a prospect’s LinkedIn posts, prices listed on a competitor’s website, job ads, ISTAT data. Off limits: emails that aren’t yours, data bought from illegal lists, information obtained by pretending to be someone else, anything behind a login that doesn’t belong to you.

Why SMEs need it: 3 uses that move revenue

Companies use open-source intelligence to explore new markets, track competitors, plan campaigns and spot early the factors that could affect operations ³. For an SME turning over €1–1.5M, that boils down to three uses that hit the bottom line.

Qualifying customers and prospects

Enrich a lead before your salesperson picks up the phone. In ten minutes before a call, you can find out how much the company turns over from its published accounts, whether it’s hiring (so it’s growing), how it sounds online, and what it complains about in public. Academic research has already validated a structured approach to competitive analysis built on open data and public search data, and found it cheap to run and rich in information ⁴. Picture a B2B training company that reads a prospect’s job ads and sees three openings for junior sales reps. That’s the perfect way in to pitch a sales onboarding programme, and the rep walks into the call with an opening line ready to go.

Understanding competitors

A competitor’s positioning is written out in plain sight: on their website, in their public prices, their offers and their hiring. A company that posts three technical roles in a region where it had no presence before is telling you where it’s heading, whether it means to or not. Collecting, analysing and interpreting information from online news, social media and commercial databases is a valuable way to find what you need for strategic decisions ³. Take an online sporting goods retailer that checks the prices of its three direct competitors every Monday and adjusts its promotions before it gets dragged into a margin-killing price war.

Reading the market

Open sources show you what’s catching on with consumers and give you the chance to get there before everyone else, or to adapt your campaigns to new trends ⁵. Reviews, industry communities, groups and forums are full of unspoken demand: the problems customers describe without anyone asking. Imagine a business software vendor that reads 200 competitor reviews on a public portal, finds that 40% of the complaints are about after-sales support, and builds its entire messaging around fast support.

The 5-phase intelligence cycle (process first, tools second)

This is the heart of the work, and it’s the part everyone skips on their way to the tools. OSINT is a process, a network of connected activities that answer one specific need. A random Google search doesn’t qualify ⁶. The classic intelligence model works in four stages (discovery, discrimination, distillation, dissemination), and it always starts with input from whoever has to make the decision ¹. For an SME, I’ve rewritten it as five phases you can run on Monday morning.

1. Define what you need to know. Start from the decision. What do I have to decide by Friday? “I need to know whether a product line for dental practices is worth launching” is a real question. “Let’s gather some data on the dental market” is a nice intention with no target. Without a question, you can’t collect anything useful, because you’d never know when to stop.

2. Collect from the right sources. Go to the sources that answer that specific question (see the table below) and ignore everything else. The real difficulty is picking out the relevant, reliable sources from a huge mass of public information ¹. Always write down where each piece of data came from.

3. Verify and cross-check. One source doesn’t make a fact. Open sources aren’t always reliable, and they have to be checked for authenticity and accuracy ². If a company claims 50 employees on its website but its accounts suggest 12, you’ve found a discrepancy that tells you more than either number on its own. Confirming who actually owns a business, for example, means comparing online sources against official company registers ⁷.

4. Analyse. Move from a list of facts to an insight. Intelligence means the added value of analysis: the ability to read a mixed set of information and pull out an answer to the question that started the search ⁶. A hundred reviews are useless until they become “three recurring problems where the competitor is weak”.

5. Act and update. Who does what, and how often. The output is a brief that lands on the decision-maker’s desk with an expiry date. Markets move, so the prospect brief you wrote in January needs a refresh before the March call.

The leap in quality happens between phase 3 and phase 4. Anyone can collect data. Analysis is what makes building a process worth the effort.

Public sources to start with (Italy)

The first skill, often wrongly taken for granted, is knowing the sources and what each one can give you ⁶. These are the public sources an Italian SME actually has at hand, for free or close to it.

Source	What you’ll find	Marketing/sales use
Registro Imprese / Chambers of Commerce	Company filings, published accounts, officers, registered office	Size up a prospect, check financial health, work out who makes the decisions
ISTAT	Industry data, demographics, consumer spending	Size a market or niche before you invest
UIBM / EUIPO	Registered trademarks and patents	See where a competitor is innovating or protecting itself
Reviews and industry communities	Complaints, requests, the words customers actually use	Sharpen messaging, the offer and sales objection handling
Competitors’ websites and legal notices	Public prices, terms, positioning	Competitive comparison and points of difference
”Careers” pages	Open roles, locations, skills in demand	Read a competitor’s future strategy
Wayback Machine	Past versions of websites	See how a competitor’s positioning has shifted over time

There’s one practical rule almost everyone ignores. Most public data online isn’t indexed by search engines like Google, so if you only search Google you’re seeing the tip of the iceberg ³. Registers, review portals and databases have to be queried directly.

How AI speeds up each phase (with ready-to-use prompts)

OSINT has always come down to method: turning scraps of public information into working knowledge through collection, correlation, verification and interpretation ⁷. AI speeds up every one of those phases, provided the process underneath is already sound. Collect badly and AI just hands you a fast summary of bad data.

The sheer volume of data is why speed matters. According to an IBM estimate, around 90% of all the data ever produced was created in the last two years, at a rate of 2.5 quintillion bytes a day, and 90% of it is unstructured ⁸. Faced with that volume, a human analyst hits a physical wall ⁷. This is where AI earns its keep, as long as you give it the right jobs.

Ready-to-use prompt for summarising reviews (voice of customer)

“Here are 60 public reviews of product [X]. Group the content into no more than 5 recurring themes. For each theme, give the approximate percentage of reviews that mention it, 2 representative verbatim quotes, and whether the comments are positive or negative. Don’t add any themes that don’t appear in the text.”

Ready-to-use prompt for classifying and de-duplicating collected data

“This is a messy list of 40 companies with data from different sources. Merge the duplicates (the same company written in different ways), flag rows where the data conflicts, and sort by estimated revenue, highest first. Mark any data point that appears in only one source with [TO VERIFY].”

Ready-to-use prompt for pulling insights from a set of accounts or a long page

“Here are the published accounts for [company]. Put revenue for the last 3 years, the percentage change, headcount and profit or loss into a table. Then write 3 observations for a salesperson who needs to know whether the company is growing and has budget.”

Ready-to-use prompt for the sales target brief

“From this raw data on [prospect], write a half-page brief for the salesperson: who they are, what they turn over, signs of growth, the problem we’re most likely to solve for them, and a suggested hook to open the call. Keep it tight, no filler.”

Language models do well at three levels. They structure raw data during collection, compare names, bios and activity to spot discrepancies during verification, and summarise during analysis ⁷. Some jobs still need to stay with people. An analyst comparing profiles with AI can spot discrepancies in real time, but deciding what they mean is still your call ⁷. There’s also a risk to be aware of. AI-generated disinformation and deepfakes make it harder than ever to trust what you see online, which makes cross-checking more important than it’s ever been ⁷.

Legal and ethical lines: what you can (and can’t) do

An open source still comes with limits on how you use it. OSINT sources must be legally accessible to the public without breaching copyright or privacy law, and that line holds even when the data is sitting right in front of you ³. Public information isn’t yours to use however you like, especially when it concerns individuals.

The most useful working distinction is between company data and personal data. A company’s revenue, registered office, officers and accounts give you a lot of room. Data that relates to an individual falls under GDPR, which requires a stated purpose, a lawful basis and data minimisation: you collect only what you need for that decision. Pairing your tools with ethical and legal criteria reduces security and privacy risks and cuts down on false positives ⁹.

Green light: published accounts and company filings, public prices, reviews, job ads, content a company publishes on its own official channels. Red light: scraping that breaches a site’s terms of service, personal data collected without a purpose and lawful basis, keeping data indefinitely, profiling individuals without a privacy notice.

This isn’t legal advice. Before you systematise the collection of data that relates to people, have your DPO or lawyer sign off on the process, and keep the guidance from the Garante per la protezione dei dati personali (Italy’s data protection authority) to hand.

Where to start on Monday morning (checklist)

You don’t need a team of analysts. A short, repeatable routine that anyone in the company can follow will do.

1. Write this week’s decision question in one sentence (phase 1).
2. Pick 3 sources from the table above, and no more.
3. Set up a dedicated account and use a separate browser so your personal browsing stays apart from the research.
4. ALWAYS record where each piece of data came from, right next to the data itself.
5. Cross-check every piece of information against at least one other source before you treat it as true.
6. Finish with a half-page brief that answers the question from step 1, with a date for the next update.

I see the same three mistakes in SMEs over and over: collecting without a question (and drowning in data), trusting a single source, and not recording where data came from (and ending up with a brief nobody can check). If you want to run the summarising and classifying phases without building everything by hand, our pay-as-you-go AI tools do exactly the heavy lifting of the prompts above and leave the decision with you.

Wrapping up, plus FAQs

Open-source intelligence costs very little. Mostly it asks for discipline. The information advantage it gives you is structural: whoever has the best sources and reliable tools builds a lead over the people going on gut feel ⁷. Start with a question, collect from a handful of verified sources, let AI handle the repetitive analysis and keep the judgement for yourself. The process pays for itself from your very first sales call.

Is OSINT legal in Italy? Yes, as long as you collect from sources that are legally accessible to the public without breaching copyright, privacy or terms of service ³. Personal data falls under GDPR, which requires a purpose, a lawful basis and data minimisation.

How is OSINT different from market research? Market research is usually a one-off study you commission from an outside firm. OSINT is an ongoing, in-house process that runs every week and stays current as customers and competitors move.

Do I need paid tools? Not to get started. Chamber of Commerce registers, ISTAT, reviews and competitors’ legal notices are free, and public information costs next to nothing ². Paid tools only come in when you scale up volume and frequency.

How long does it take to do properly? A solid prospect brief takes 10–15 minutes per person with the 5-phase process, less if you use AI for the summary. Most of the time goes into analysis, which is the phase you shouldn’t hand off.

Sources

Footnotes

1. Open Source Intelligence — Wikipedia. it.wikipedia.org ↩ ↩² ↩³

2. Chi è e cosa fa l’analista OSINT. cybersecurity360.it ↩ ↩² ↩³ ↩⁴

3. Open Source Intelligence (OSINT) e Sicurezza. ictsecuritymagazine.com ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

4. Using open data and Google search data for competitive intelligence analysis.. search.ebscohost.com ↩

5. OSINT: Concetto, Applicazioni e Ruolo nei Big Data e nella … ictsecuritymagazine.com ↩

6. Ecco l’Open Source Intelligence (Osint) per le indagini … agendadigitale.eu ↩ ↩² ↩³

7. AI-OSINT: quando l’intelligenza artificiale ridefinisce i … ictsecuritymagazine.com ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

8. OSINT nei Big e Fast Data: Come Raccogliere e Analizzare … ictsecuritymagazine.com ↩

9. OSINT, dieci strumenti gratuiti essenziali: una guida completa. agendadigitale.eu ↩