OSINT-Based Spear Phishing
Details your organization publishes can make a false request sound informed. AwareX turns that approved public context into verification drills your team reviews.
Explore the approachWhat your business publishes can become an attacker’s opening.
Public business facts can make an unauthorized request sound informed. AwareX turns approved public context into reviewed verification drills.
An attacker reads the company’s offsite announcement and sends marketing a request to upload the year’s campaign plan to an unfamiliar workspace.
Fictional workplace example, not a live attack or measured customer result.
- 01 / WHAT ROUTINE TRAINING MISSES
Training ignores the public footprint.
A generic campaign does not show employees how legitimate business facts can be reused in a deceptive message.
- 02 / WHEN THE REQUEST FEELS REAL
Accurate details can create misplaced trust.
A request that names the right project or colleague can encourage sharing information with an unverified contact.
- 03 / WHERE AWAREX CHANGES THE REHEARSAL
Rehearse the public-context lure.
AwareX uses approved public signals to shape relevant scenarios. Your team reviews the story before employees encounter it.
Routine compliance training vs. AwareX
Compliance learning establishes a foundation. AwareX puts AI behind the rehearsal: it studies your approved context, drafts the scenarios, and adapts what people practice next.
| What matters | Routine compliance training | AwareX approach |
|---|---|---|
| Starting point | A scheduled course built around policies and general awareness. | AI studies your approved business context first, so the first test reflects how you work. |
| Workplace relevance | The same broad examples for every responsibility. | AI drafts role-specific versions for finance, HR, IT, and leadership; your team approves each. |
| What people practice | Recognizing terms and selecting answers in a lesson. | AI adapts sender, story, tone, and difficulty from each response. |
| Follow-through | Completion often becomes the finish line; reinforcement is rarely built in. | AI reads each click, report, and pause, then sets the next round from the missed cue. |
| What success means | Attendance, course completion, and assessment scores. | The decisions people make in rehearsal, tracked by AI across rounds, not one quiz. |
This compares a completion-focused training approach, not every training provider. AI output is reviewed by your team before release, and capabilities and scope are confirmed in your demo. Training does not guarantee attack prevention, compliance, or certification.
From recognizing a message to rehearsing a response
Will the recipient verify authorization even when the message gets the business details right?
Rehearse the decisionExplain the missed cuePractice again
What is OSINT-Based Spear Phishing?
The research comes first: public posts, announcements, and profiles become the angle of attack. The exercise rehearses how a request that sounds internal is still verified before it is trusted.
Built from public signals
The AI agent reads the same open sources an attacker would: posts, announcements, profiles, and job listings.
The angle, not the address
The deception is the relevance: the request fits the week your team is having, which is exactly why it deserves a check.
The decision is the result
Uploading, approving, or replying is rehearsed as a verification decision, not a spot-the-typo game.
An attacker reads the company’s offsite announcement and sends marketing a request to upload the year’s campaign plan to an unfamiliar workspace.
Illustrative example. Public-signal sources in scope are confirmed with your team, and every scenario is reviewed and approved before it runs.
New to the term? Read the guide: What is spear phishing?
How AwareX AI makes it more effective.
No generic templates. AwareX agents read what is happening at your company and build department-specific tests from it.
Public footprints become the perfect pretext.
- Scan the web
- Read the news
- Map the people
- Write the pretext
- Send for approval
- Engineer posted a conference talk
- Recruiter shared a hiring post
- CFO quoted in a press release
Message from Conference organizer
Your speaker slides: upload by Friday
Loved your recent post. Could you take a look at the brief I've shared before Friday?
brief-shared.example
Awaiting your approvalIllustrative example. Signals, names, and messages are not real customer data.
The AI agent does the open-source research an attacker would do, reading public posts, announcements, and profiles to find the angle.
It drafts the lure from that context, and your team approves it before anything is sent.
The program learns which context fooled whom, sharpening the next round.
AI proposes; people decide. Every scenario is reviewed and approved by your team before it reaches an employee.
Every answer changes the next test.
Each response is read as a signal, not filed away as a score. The AI engine moves each person one step up or down seven difficulty levels, so nobody meets a deepfake call before they can spot a fake invoice, and nobody stays on obvious spam that teaches them nothing.
- Reported it in time
The next test moves a step up the ramp: a more familiar sender, a tighter story, or a second channel arriving behind the first.
- Clicked, then raised it
The level holds. The lesson names the exact cue that was missed, and that cue returns in the next wave until it is recognized on sight.
- Missed it entirely
Coaching comes first, not embarrassment. The next test keeps the same theme with clearer warning signs, then rises again once the habit holds.
Adjustments belong to the person, not the whole company. Your team still reviews and approves every wave before it runs.
- Obvious phishing
- Realistic corporate
- Spear phishing
- Business email compromise
- Executive impersonation
- Multichannel story
- Deepfake + social engineering
Why it matters: a result only means something when you know how hard the test was.
A familiar moment. A decision worth rehearsing.
OSINT-Based Spear Phishing, rehearsed through the decisions around a marketing offsite and a campaign plan.
- A realistic message lands in the flow of work.
- Each cue is inspected one by one, from the sender to the deadline.
- The safe response is rehearsed: report it, verify it, or ask.
A person reviews every scenario.
Illustrative screens, not live product screenshots. Messages, identities, and destinations are fictional; no links, payments, approvals, or uploads are active. Confirm capabilities in a demo.
One check today.
A safer routine every day.
Use your public business context in a safe fire drill. Familiar facts should trigger a check of the instruction, not automatic trust.
Explore the fire-drill approachCaptured platform preview. Figures are example data, not measured customer results.
- 01
A drill, not a checkbox
A signed policy fades within weeks. A rehearsed pause, verify, and report habit holds when a real message lands.
- 02
Practice where decisions happen
Short, contextual exercises arrive in the flow of work, in the channels your teams actually use, instead of a once-a-year course.
- 03
Learn, never blame
A miss is data for the next exercise, not a mark against a person. Repeated practice is what moves the numbers.
IMPROVE.
One continuous loop.
Identify, Measure, Prioritize, Reduce, Optimize, Validate, and Evaluate. AI connects business context, employee responses, and targeted learning to inform each next test.
Explore related solutions.
Clarity before
the next step.
What is OSINT-based spear phishing?
OSINT-based spear phishing uses open-source intelligence, meaning publicly available information, to tailor a deceptive message to a person or organization. Company websites, announcements, and job posts can supply the context for a convincing workplace request.
What public information can be used in a targeted phishing email?
Public role descriptions, team pages, event announcements, supplier references, and business updates can reveal names, responsibilities, and timing. None of these details proves an incoming request is genuine, even when the message describes the business accurately.
Does OSINT phishing require access to confidential company data?
No. An attacker can build a plausible story from public information without accessing internal systems. Confidential data may add further context, but an accurate reference to an offsite or project does not demonstrate authorized access or identity.
How does AwareX use public context in spear phishing simulations?
AwareX reads public business signals to propose a role-relevant scenario. Your team reviews the context and approves the draft before delivery. The exercise rehearses verification without treating public knowledge about the organization as proof of legitimacy.
How can employees verify a request that mentions real company activity?
Confirm the instruction through a known colleague, listed service desk, or approved workspace. Do not rely on the sender knowing a real event or employee name. Keep payment, access, and information-sharing approval steps intact.
How can organizations reduce risk from publicly available business information?
Review what business details are published, set appropriate employee guidance, and rehearse contextual phishing scenarios. Public visibility cannot be eliminated, so independent verification, reporting, and consistent approval controls remain important alongside publication policies.
