Research
Tradecraft, published.
Field notes, methodology and practical guides written by the investigators who run our cases. We publish how we work because methods that cannot be explained should not be trusted, and because better tradecraft across the field makes everyone harder to deceive.
Library
All research
Filter by type. Field notes reconstruct real investigations with identifying details changed. Methodology pieces explain the standards behind our reports. Guides are practical references for teams doing this work themselves.
Outlook 2027: six shifts in the open-source threat picture
Synthetic identities, rented infrastructure and faster rumor cycles are changing what open sources can prove. What we expect next year, and how we are preparing.
Read the outlookOne tag, 212 domains: a field note on infrastructure pivoting
How a reused analytics identifier, certificate history and registrant patterns turned a list of scam sites into a map of one operation.
Read the field noteAttribution is a standard of proof: how we grade confidence
Why we separate source reliability from information credibility, and how a finding earns the word "high" in our reports.
Read the articleVerify before you panic: testing a breach claim without buying the data
Most extortion claims are tested in the first 48 hours. A method for judging a leak from its samples, its seller and its history, without paying anyone.
Read the guideSeven signals that separate a network from a crowd
Organic outrage and coordinated campaigns can look identical at a glance. These are the signals that tell them apart.
Read the analysisThe candidate who is not there: twelve signals of remote hiring fraud
Borrowed identities now pass interviews and background checks. The public signals that expose them, and how to check without treating every applicant as a suspect.
Read the analysisSeeing through nominee directors: a field guide for due diligence teams
Registry red flags, a six-step method for reaching the real owner, and what to do when the paper trail runs out.
Read the guidePast tier one: mapping a supply chain from public records
Your suppliers know their suppliers. You usually do not. How trade data, registries and local sources rebuild the tiers a questionnaire never reaches.
Read the guideIf you did not preserve it, it did not happen: evidence handling for OSINT
What a defensible capture contains, how hashing protects the chain of custody, and the mistakes that sink online evidence.
Read the guideVerified, not viral: how we confirm events before clients act
A first report is a lead, not a fact. The five tests an event must pass before we tell a client to move people, and what we say while we are still checking.
Read the articleMachines for volume, people for judgment: how we use AI in investigations
Where machine assistance earns its place in our workflow, the five things it is never allowed to do, and how every assisted step stays checkable.
Read the articleStart an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.