What cyber and OSINT investigation covers
- Open-source intelligence (OSINT) — collation of publicly accessible information about a person, organisation, asset, or event from social media, public records, court records, news archives, registries, and similar sources;
- Digital footprint analysis — building a coherent picture of a subject’s online presence, account ecosystem, and behavioural patterns from public material alone;
- Attribution work — connecting an anonymous online identity (account, handle, alias) to a real person or organisation, where this is possible from lawful sources;
- Dark-web monitoring — passive observation of dark-web marketplaces and forums for material relating to your matter;
- Reporting for review — findings packaged for legal disclosure, with sources cited and methodology explained.
When clients engage us for online investigation
- A company has discovered intellectual property, customer data, or internal documents being shared online and needs to identify the source;
- A litigation team needs evidence of a counterparty’s online conduct, asset disclosures, or representations;
- An HR or compliance investigation needs a thorough, lawful background sweep of an individual;
- A private individual is being harassed online by an account whose real identity is unknown.
How we investigate online, lawfully
Cyber work uses only open-source, passive, and lawfully obtained information, in accordance with the Computer Misuse Act 1990. We do not access computer systems, accounts, or data without lawful authorisation. We do not use pretext or impersonation to obtain account information. Where authorised access is part of an engagement (for example, an employer asking us to examine a company-owned device), we agree the authority, scope, preservation method, and any specialist examination required before access. Ownership of a device alone does not authorise unrestricted access to every account or communication on it.
Personal data gathered in the course of an investigation is handled in accordance with the UK GDPR and the Data Protection Act 2018. For our full process, see how we work.
Online research or a harassment investigation?
OSINT describes a method: investigating information available from lawful, open sources. It can support due diligence, tracing, or an enquiry into online conduct. If your immediate concern is an anonymous threat, impersonation, or repeated unwanted contact, start with our online harassment investigation service and its practical guidance.
For an initial enquiry, describe the question you need answered and any deadline. You do not need to send account names, screenshots, or sensitive material before we agree a suitable channel. Our first-contact guide explains the next step.
Common questions
Do you access private accounts or devices?
No. Our cyber work uses only open-source, passive, and lawfully obtained information, within the Computer Misuse Act 1990. We do not access systems, accounts, or data without lawful authorisation, and we do not use pretext or impersonation to obtain account information.Can you identify who is behind an anonymous account?
Often, though not always. Attribution connects an anonymous handle to a real person or organisation using lawful sources such as public records, cross-platform patterns, and archived material. We tell you at the scoping stage how likely a result is before you commit to anything.Can the findings be used in legal proceedings?
Findings may support proceedings. We identify sources, explain methods and limitations, and agree reporting requirements with the instructing solicitor. The court decides admissibility and weight; a report cannot guarantee either. Witness statements can be agreed where required.More general questions about cost, timescales, and evidence are answered on our FAQs page.