At the INCYBER Forum, OSINT reaches new heights
![Image [Xinghe AI Network Security Agentic SOC]: is China preparing the industrialization of autonomous cybersecurity?](https://incyber.org//wp-content/uploads/2024/03/adobestock-749446930-1-885x690.jpeg)
This year, the now well-known “OSINT Day” of the INCYBER Forum was held on the top floor of Lille’s Grand Palais, in a room twice the size of the one that hosted it during the previous edition. OSINT is reaching new heights: with 2,500 participants, the room remained full throughout the day, reflecting the growing enthusiasm for the discipline, which continues to attract more and more followers across all fields.
It is difficult to put a figure on the Open Source Intelligence (OSINT) market or the size of its ecosystem. For 2025, analysis firms have published estimates ranging from 4.3 to 18 billion dollars, depending on what they include, with projections for 2035 ranging from 9 to 133 billion. The gap is not a methodological inaccuracy. It stems from what is placed under the term: if one focuses only on specialized tools, the market amounts to a few billion; if all cyber intelligence is included, some firms rank Google or Palantir among the leading “OSINT providers.” This reflects systemic ambiguity over what the term covers and the boundaries of the discipline, both in terms of methods and tools, and in terms of uses.
“OSINT is sometimes reduced to digital investigation techniques. But its real strike force lies in the combination of data, logic and geopolitical expertise.” Marc-Antoine Brillant, head of department at VIGINUM, the SGDSN service responsible for detecting foreign digital interference, immediately set the tone for the day. Collecting is not enough. “You can collect thousands of data points in a few minutes and still have no knowledge or usable intelligence,” as summarized by Tomislav Dokman, Director of the International OSINT Centre of Excellence in Zagreb. In the following session, Mihaela Curca, from the Romanian National Cyber Security Directorate (DNSC), also extended this idea. OSINT is not simply monitoring social networks, but “the structured collection, validation, analysis and presentation of public data.”
She recalled that it was with the war in Ukraine that we had, “for the first time, near real-time visibility over a major conflict,” and that this visibility legitimized the discipline in the eyes of the general public. “We can no longer treat this informally; [OSINT] must be properly institutionalized, in an ethical, responsible and trustworthy manner.” Faced with this need to institutionalize a discipline that is, by nature, open, OSINT communities are mobilizing. In France, the Oscar Zulu OSINT Crew announced the launch of its “Permis d’osinter.” “Some want to regulate OSINT in France? Very well. We started at the beginning: a test to check that we at least know what we are talking about. […] No meetings, no votes, no strategic committee. We did it like a rhinoceros with an idea in its head: head down, straight ahead, and we deal with the details along the way,” reads the community’s LinkedIn post. This logic of rapid action contrasts with the delays inherent to bureaucratic mechanisms and reflects the communities’ desire to retain the initiative in structuring the discipline.
Methods and uses: going beyond the toolkit
Military intelligence, journalistic investigation, counter-disinformation, genealogical research, searches for missing children, GPS jamming tracking… The variety of uses, as well as tools, presented at OSINT Day does not diminish the primacy of analysis over collection and technique. “There are 5,000 accessible OSINT tools. Who masters them all? No one! And no one should try!” For Tomislav Dokman, the abundance of software requires rigorous sorting discipline, otherwise the analyst risks being paralyzed by the weight of the data. Intelligence only begins after raw collection. For the Director of the Zagreb International Centre of Excellence, untreated data remains a neutral signal, whereas intelligence requires an interpretation process capable of “reducing the decision-maker’s uncertainty.” Without the analytical layer, the researcher is exposed to their own cognitive biases, illustrated by the classic drawing of the young or old woman, where the same image produces two opposite conclusions.
The industrial response, for its part, is adapting to a need for speed. The OSINT Industries platform, presented by its co-founder, queries 1,400 sources simultaneously from a single selector, whether it is an email address, a telephone number or a username. The tool operates in real time without storing flows. Its specificity lies in passive queries executed by robots in the background. This technical choice neutralizes the alert systems of target platforms, which notify users of suspicious login activity at the time of the query.
The method was put to the test during a hunt conducted on an image sales and sharing forum, targeted because of moderation failures linked to child sexual abuse content hidden under “artistic” or “family” categories. A dedicated script scanned 90,000 URLs and 90,000 albums to extract 32,000 users and 3,400 email addresses found in comments. A locally operated artificial intelligence system summarized the profiles to identify 1,189 individuals who had been active over the past twenty years. The identification of a suspect located in Nantes was made possible thanks to EXIF metadata from photos posted on Google Maps. The exact type of phone, geographic routines and contact points aggregated in this way formed an evidence file that was handed over to French law enforcement.
Communities, an ecosystem
The raw material of this ecosystem is first and foremost its communities. OSINT Day brings together a dense network of associations that came to present their feedback: Project FOX, a collective of enthusiasts created in late 2020; OSINT-FR, the largest French-speaking community in the discipline; and the OSINT & Monitoring Club of the École de Guerre Économique. These are the volunteers, researchers and students that institutions are now seeking to connect with. All the State representatives present that day defended the creation of direct bridges between civil society, companies and State structures. The French Army is trying to apply this approach through the Specialist Reservist Intelligence Battalion (B2RS), created in 2024. The project aims to reach a workforce of 1,500 operators by 2030. Captain Olivier detailed how the 5th Company, based in Lille, operates, built around the intersection of academic and technical skills. Students in geopolitics, law and data engineering collaborate there during operational sessions, while linguists decipher local contexts and IT specialists streamline access to open-source databases.
This desire for openness, and above all this call to civil society, is also found at the Quai d’Orsay. “We need to stick together — not only between States and ministries, but also between citizens — in order to pool our resources,” said Guillaume Kuster, Deputy Director at the Communications Directorate of the Ministry for Europe and Foreign Affairs. To that end, he announced the creation of a “digital reserve,” a network of volunteers wishing to contribute to the information fight. “We need to create short loops and exchange information. We must create an ecosystem that includes the media and companies in the sector — a kind of Team France,” he explained. Marc-Antoine Brillant from VIGINUM defended the same approach by announcing the creation of an academy to combat information manipulation. Its purpose will be to produce large volumes of educational resources and, in time, to offer training for the media, administrations and companies.
OSINT Day 2026 showed a field in full ascent, one that has moved beyond the margins of enthusiasts to establish itself at the crossroads of State intelligence, the market and civil society. What remains essential was summarized by Tomislav Dokman: “Being good at OSINT is above all knowing what to do when the tools reach their limits.”