OSINT at NIIS 9 is adversary rehearsal, performed with authorization and aimed at an organization’s own footprint. The question is simple: what can a patient stranger assemble about your people, your devices, and your infrastructure without ever sending a packet at you?
Radio makes the answer larger than most teams expect. Wardriving datasets map access points to street addresses. Bluetooth names announce device models and sometimes owners. App builds ship their own endpoint lists. Certificate transparency logs publish the staging hosts nobody meant to keep.
What an exposure review covers
- Infrastructure footprint: certificate transparency, DNS history, cloud storage naming, and forgotten staging hosts.
- Radio footprint: SSIDs, BSSIDs, and device names that public wardriving and Bluetooth datasets already tie to locations.
- Application footprint: shipped builds, SDK inventories, embedded endpoints, and keys that should never have left CI.
- People footprint, with consent: executive and high-risk staff exposure across breach corpora, data brokers, and social metadata.
Where it stops
Exposure work targets an organization and the people who asked to be assessed. It does not profile private individuals, it does not buy stolen data, and it does not touch accounts that are out of scope. The deliverable is a map of what is findable and a plan to make less of it findable: takedowns, configuration changes, naming hygiene, and habits.
Most reconnaissance is not hacking. It is reading, carefully, what the target already published.