TL;DR:

  • Attackers research targets before striking, using publicly available information to find weak points — domain registrations, LinkedIn profiles, DNS records, and leaked credential databases are all freely searchable
  • You can check what’s visible about your business yourself using the same free tools attackers use
  • Reducing your attack surface — tightening what’s exposed publicly — makes your business a harder and less attractive target

Open-source intelligence, or OSINT, is the practice of gathering information from publicly available sources. Security researchers and penetration testers use it to understand what’s exposed about a target before doing any active probing. The problem is that anyone can do it — including the people targeting your business.

Before most cyberattacks happen, there’s a reconnaissance phase. Attackers gather information about the target: what systems they run, who works there, which email addresses are active, whether any passwords have appeared in previous data breaches. This research takes minutes with free tools, and for most small businesses, the results would be eye-opening.

Here’s what attackers look for, and what you can do about it.

Your Domain and DNS Records

DNS records are public by design — they have to be, so the internet knows where to deliver your email and where your website lives. But the full DNS picture of a domain reveals more than most businesses realise.

Try this: go to MXToolbox and look up your domain. You’ll see:

  • MX records: which email provider you use (Microsoft 365, Google Workspace, your own mail server)
  • SPF, DKIM, and DMARC records: whether your email is properly protected against spoofing — missing or misconfigured records are an open invitation for attackers to impersonate your business in emails
  • A and CNAME records: the IP addresses and services your domain points to, which may reveal hosting providers or old subdomains you’ve forgotten about

Old subdomains are a particularly common issue. old.yourbusiness.co.uk, staging.yourbusiness.co.uk, test.yourbusiness.co.uk — if these resolve to live servers, they may be running outdated software with unpatched vulnerabilities. An attacker will find them with automated subdomain enumeration tools.

What to do: Audit your DNS records with MXToolbox. Ensure DMARC is properly configured (set to p=reject if possible). Delete DNS records that point to services you no longer use.

Companies House and Business Registrations

For UK businesses, Companies House is a goldmine of publicly available information. A free search on companies-house.service.gov.uk shows:

  • Director names and addresses (home addresses are sometimes on older filings)
  • Filing history including annual accounts, which can reveal company size and financial health
  • Previous addresses and related business entities

Attackers use this to build targeted spear phishing emails — “Dear [Director Name], I’m following up on your recent filing…” — and to identify high-value individuals to target. Directors, company secretaries, and finance signatories are the typical targets because they have authority to authorise payments and wire transfers.

What to do: Review your Companies House filings and use a service address (your accountant’s address or a registered office service) rather than your home address on director filings. You can apply to suppress personal addresses that appear on older filings.

LinkedIn and Employee Profiles

LinkedIn reveals who works at your company, what their roles are, what software they claim to know, and often which projects they’ve worked on. For an attacker planning a social engineering campaign, this is the staff directory.

Common information attackers extract from LinkedIn:

  • Finance, HR, and IT staff names — these roles are primary targets for BEC (Business Email Compromise) and payroll fraud
  • The email format your company uses (firstname.lastname@company.co.uk or firstlast@company.co.uk) — easily confirmed from a few visible email addresses and then used to guess the rest
  • Technology stack clues from employee skill listings (“Microsoft Azure”, “Salesforce Administrator”) that indicate which platforms to target

What to do: Encourage employees to keep LinkedIn security-conscious — limiting publicly visible details to what’s professionally necessary. Ensure your finance and payroll team understand that instructions arriving via email, even from seemingly internal addresses, should be verified by phone before payments are processed.

Have Your Credentials Been Leaked?

When data breaches happen at other companies, the exposed data — email addresses, password hashes, and sometimes plaintext passwords — ends up circulating in cybercriminal communities and on dark web marketplaces. Your employees’ business email addresses may have been in dozens of breaches from services they signed up for over the years.

You can check whether your business email domain has appeared in known breaches:

  • Have I Been Pwned — search individual email addresses or your entire domain (domain search is free for verified domain owners)
  • NCSC’s Early Warning service — notifies UK organisations when their email addresses appear in breach data

If an employee used their work email to sign up for a third-party service that was breached, and they reused their work password on that service, attackers may have valid credentials to your systems right now.

What to do: Sign up for NCSC Early Warning and Have I Been Pwned domain monitoring. Immediately require password changes for any email addresses that appear in breach data. Enforce password managers and 2FA to prevent password reuse.

Your SSL Certificate History

Certificate Transparency logs are public records of every SSL certificate issued for every domain. This means you can search for all subdomains that have ever had a certificate — including internal-facing services that were briefly exposed, test environments, and staging sites.

Search crt.sh for your domain. If you see subdomains you don’t recognise or weren’t expecting, they may be running on infrastructure you’ve forgotten about.

Putting It Together: The Attacker’s View

An attacker targeting a UK small business might spend 30 minutes gathering:

  • Your director names and a direct phone number from Companies House
  • Your email format and several employee names from LinkedIn
  • Two or three old subdomains from DNS and certificate logs
  • Three or four employee email addresses that appeared in a previous data breach
  • The fact that your DMARC is set to p=none (monitoring only, doesn’t block spoofed emails)

With this, they have enough to craft a convincing phishing email, send a spoofed invoice from your domain, or attempt credential stuffing against your email provider.

The good news: checking these sources yourself takes less time than the attack takes to prepare. An annual OSINT review of your own business — DNS, Companies House, Have I Been Pwned, and certificate transparency logs — identifies the most obvious exposures before anyone else acts on them.