Tools are not tradecraft: how we choose, test and retire OSINT tools

The question we are asked most often by teams building an OSINT capability is which tools to buy. It is the wrong first question. The right one is what you need to be able to prove, to whom, and how you will show that you proved it lawfully. The tools follow from the answer.

Mindset first

The investigators who perform best at Aldervane are not the ones with the longest bookmarks list. They are the ones with patience, skepticism and a stubborn interest in why something does not fit. They read primary documents, notice the date that is a year off and keep asking what else would explain the evidence. Tools make those people faster. They do not make anyone else into those people.

That is why our hiring exercise is done in a browser, with ordinary search engines and public records, and why our training spends more time on method than on software. A strong investigator with basic tools will outperform a weak one with an expensive suite, and will be able to explain every step.

Tools come and go

Of the 212 tools and services our analysts were using at the start of 2023, 64 had been retired by the end of 2025. Some were shut down, some changed their terms or data sources, some were acquired and some simply stopped working when the sites they relied on changed. Methods have a far longer life. Pivoting from one identifier to another, reading the documents behind a registry entry, preserving before analyzing and stating confidence honestly were good practice a decade ago and will be in a decade's time.

Automation often creates work

Automated collection is seductive because it produces volume instantly. Volume is not progress. In our test of automated username enumeration, described in A matching username is a lead, not a person, five in six hits belonged to someone else, and verifying the list took longer than generating it. The same pattern holds for bulk scrapers, automated link charts and aggregated profile services. They are useful for discovery, and every item they produce is a lead until an analyst has verified it.

Six questions every tool must answer

Before any tool is approved for case work, our platform and standards teams review it against six questions. A tool that cannot answer them is not used, however popular it is.

1. Where does its data come from? We need to know whether results come from live public sources, from the provider's own collection or from third-party data. Tools that aggregate breached or stolen data are excluded outright, for the reasons set out in Why we do not search stolen data.
2. What does it learn about us? Cloud tools see every query. We ask what is logged, who can see it and whether the subject could ever learn they were searched. Sensitive queries never go to tools we cannot account for.
3. Does it touch the subject? Some tools interact with the sites and accounts they examine in ways the subject can notice. Anything that could alert a subject, or that involves deception, is not permitted.
4. Can its results be reproduced? If the tool returns a result, an analyst must be able to find the same fact in a source that can be captured and cited independently.
5. Are its terms compatible with our work? We read the terms of service. Where access requires agreeing to terms, we respect them.
6. What does it cost in time, not just money? A cheap tool that produces hours of false positives is expensive. A paid service that saves a day of manual work on every case is cheap.

What we use, by category

We do not publish the names of the tools we use, because the list changes constantly and because naming them invites the assumption that the tool did the work. By category, our analysts use:

• Search and discovery: several general and regional search engines, query builders and archive search.
• Records access: registries, court portals, procurement databases and newspaper archives, mostly queried directly.
• Identity and account discovery: username and account enumeration, always followed by manual verification.
• Image and media analysis: reverse image search across several engines, metadata readers and mapping and imagery services.
• Infrastructure research: domain registration history, certificate logs, passive DNS and public blockchain explorers.
• Capture and case management: our own platform, which captures full pages with hashes, extracts selectors from captured material and keeps the investigation searchable and reviewable.

Capture deserves a special mention. The tool category that has improved our work most over the years is not a search tool at all. It is the ability to capture a full page, scroll included, with its source, hash and context, at the moment an analyst sees it. That is why it sits at the center of the Aldervane platform.

Retiring a tool

Tools are re-reviewed every quarter, alongside the source categories they rely on. A tool is retired when its data sources change without explanation, its terms become incompatible with our work, its accuracy degrades or it is acquired by an owner we cannot assess. Cases that used a retired tool are not affected, because no finding ever rested on the tool itself, only on the preserved sources it pointed to.

Advice for teams building a capability

• Write down your standards before you buy anything. They will rule some tools out.
• Invest in capture and documentation first. Every other capability depends on them.
• Prefer methods to tools in training. Tools will change before the course materials do.
• Budget analyst time for verification whenever you add automation.
• Keep a register of what each tool can see about you, and review it.