Writing and handling an OSINT exposure report

Report structure

Lead with a short summary of the most important exposures and their business impact. Then list findings, each with an identifier, description, evidence such as a URL, timestamp, and screenshot, a risk rating with reasoning, and a specific remediation with an owner. Close with method, sources, scope, and limitations so readers know what was not covered.

• Executive summary
• Findings with evidence and risk
• Remediation with owners
• Method, sources, scope, and limitations

Handling the report safely

An exposure report is a map of weaknesses and may contain personal data, so treat it as confidential. Redact personal details not needed for the fix, restrict distribution, store it encrypted, and delete working notes and captures according to the agreed retention period.

Lab: write one finding properly

Take one finding from an earlier exercise in this hub and write it in the format below. Make the remediation specific enough that someone could act on it without asking you. Then review it for personal data and redact anything that is not needed for the fix.

ID: OX-03
Title: Internal procedure document indexed by search engines
Evidence: https://example.org/files/it-onboarding.pdf (captured 2026-11-02 10:12 UTC, screenshot OX-03.png)
Risk: Medium. Describes VPN client, helpdesk phone flow, and password reset steps useful for pretexting.
Remediation: Remove the file, move it to the intranet, request removal from search indexes. Owner: IT operations.
Personal data: staff names redacted from the screenshot.

Follow-up

Agree a recheck date for each finding, and confirm closure by repeating the original search or request. Track metrics such as the number of exposed documents over time to show whether prevention measures are working.