Authorised OSINT Toolkit

cloud-saas-exposure

Assess attributable cloud storage, SaaS, package-registry and cloud-native exposure using passive or read-only methods. Use only for owned or explicitly authorised targets; exclude credential submission, exploitation and control-plane access.

continuous-exposure-monitoring

Design authorised re-scan, diff, finding-lifecycle and public threat-intelligence monitoring workflows. Use for exposure monitoring programmes and alert tuning; do not schedule or contact third-party targets without explicit authority.

defensive-exposure-analysis

Analyse supplied security findings and lawfully accessible public organisational information to identify defensive exposure and remediation priorities. Use for evidence synthesis and assurance; not for scanning, account discovery, credential activity, exploitation or surveillance.

defensive-osint-planning

Plan lawful defensive public-source research and exposure reviews using user-supplied information or permitted public sources. Use for scope, collection planning, evidence standards and deliverables; not for scanning, user enumeration, credential processing, exploitation or surveillance.

email-domain-security

Analyse published DNS records to reach a defensible email-spoofability and SPF supply-chain verdict. Use for passive email-domain security reviews; do not send test mail, enumerate recipients or submit credentials.

exposure-risk-quantification

Convert existing reconnaissance findings into transparent likelihood, impact, FAIR-style loss estimates, risk scores and executive reporting. Use for analysis and communication, not target collection or active testing.

identity-security-review

Review user-supplied identity architecture, federation design and control documentation for defensive security gaps. Use for assurance and remediation planning; not for tenant discovery, account enumeration, login testing or credential activity.

org-attack-surface

Map an organisation from verified legal entities to attributable domains, ASNs, netblocks and public services. Use for authorised corporate-footprint and attack-surface discovery while separating candidates from proven ownership and scan scope.

osint-autopilot

Run the packaged deterministic external OSINT workflow against an owned or explicitly authorised domain, producing evidence and a workbook. Require scope confirmation before execution, keep discovered sibling assets out of scope, and never auto-run active exploitation.