The Adversary Is Collecting Information Regarding Your

You're at a coffee shop. You're logged into the company VPN, checking email, maybe scrolling Slack. Laptop open. That said, phone on the table. Here's the thing — feels normal. Feels safe.

It's not.

Someone two tables over isn't drinking coffee. They're watching. Not you — your screen. Your badge. The sticker on your laptop that says which division you're in. The conversation you just had on speakerphone about the Q3 rollout And it works..

They're not hacking you. They don't need to. You're handing them the pieces.

What Is OPSEC (And Why That Phrase Keeps Showing Up in Training)

OPSEC — operations security — isn't classified jargon. Also, it's a mindset. Plus, a discipline. The short version: *identify what you're protecting, figure out who wants it, and stop handing it to them on a platter.

The phrase "the adversary is collecting information regarding your...Day to day, " shows up in every military and intelligence OPSEC briefing for a reason. It's the core threat model. Finish that sentence with mission, capabilities, intentions, personnel, logistics, communications — whatever applies. The adversary doesn't need all of it. They need enough Nothing fancy..

And they're patient.

OPSEC isn't about paranoia. And it's about patterns. Adversaries — whether foreign intelligence, corporate competitors, criminal groups, or activist hackers — build mosaics. One harmless tweet. One LinkedIn update. One overheard conversation. Now, one metadata leak. Individually, noise. Together, a picture.

That picture lets them predict. Influence. Disrupt. Sometimes destroy It's one of those things that adds up..

It's Not Just for Spies Anymore

Twenty years ago, OPSEC was military. Worth adding: classified. Because of that, need-to-know. Now? Because of that, if your company has intellectual property, customer data, a supply chain, or a public reputation — you're a target. Ransomware gangs do OPSEC on you before they hit. They know your on-call rotation. Your backup schedule. Which vendor manages your firewall.

Nation-state actors map your org chart before sending a single phishing email.

Activist groups track executive travel through public flight data and Instagram stories.

The adversary is collecting information regarding your attack surface — and most organizations have no idea how big that surface actually is.

Why It Matters: The Cost of "Harmless" Information

People hear "information collection" and think theft. That's why hacked databases. That's the loud version. Stolen files. The quiet version is worse because you never know it happened Worth keeping that in mind..

The Mosaic Effect Is Real

Intelligence analysts call it the mosaic effect. Day to day, unclassified + unclassified = classified. Public + public = actionable intelligence.

Real example: A defense contractor's project manager posts a "proud moment" photo of their team at a test range. And background shows a tail number on a test aircraft. Which means metadata reveals GPS coordinates. A foreign analyst cross-references flight tracking data, correlates with known test schedules, and now they know what is being tested, where, and when the next window likely is That's the part that actually makes a difference. That's the whole idea..

Nobody stole anything. Consider this: everything was public. The damage is done.

Social Engineering Runs on Open Source

Phishing isn't "click this link." Modern spear-phishing is context-aware. The adversary is collecting information regarding your org chart, current projects, vendor relationships, even vacation schedules — then crafting emails that look indistinguishable from internal traffic Surprisingly effective..

"Hey, per our conversation yesterday — here's the updated spec doc for Project Aurora."

If you posted about Project Aurora on LinkedIn last month, and your calendar shows a meeting with that vendor yesterday, and the sender's display name matches your colleague — you click. That's not a technical failure. That's an OPSEC failure.

Competitive Intelligence Is a Legitimate Industry

Corporate competitors hire firms to legally gather everything about you. Patent filings reveal R&D direction. Job postings reveal your tech stack. Glassdoor reviews reveal org structure and pain points. Conference speaker bios reveal strategic priorities. DNS records reveal shadow IT That's the part that actually makes a difference..

All legal. All collected. All analyzed.

If you don't know what you're leaking, you're not competing — you're feeding them.

How Adversaries Actually Collect Information

This isn't magic. It's methodology. Understanding the how is the only way to disrupt it.

Open Source Intelligence (OSINT) — The Foundation

OSINT is the discipline of collecting and analyzing publicly available information. And it's not hacking. It's research — systematic, automated, and relentless.

What they look for:

• Employee names, titles, reporting lines (LinkedIn, company directory pages, conference attendee lists)
• Technology stack (job descriptions, Stack Overflow questions, GitHub repos, DNS records, SSL certificates)
• Physical locations (badge photos, office tour videos, EXIF data on uploaded images)
• Project codenames and timelines (press releases, earnings calls, speaker abstracts, regulatory filings)
• Vendor and partner relationships (case studies, "we're proud to partner with" pages, procurement databases)
• Personal details for social engineering (Facebook, Instagram, Strava, Venmo — yes, Venmo)

Tools they use: Maltego, SpiderFoot, theHarvester, Recon-ng, Shodan, Censys, FOCA, Google Dorks, custom scrapers. Many are free. All are scalable Simple, but easy to overlook..

Social Media — The Gift That Keeps Giving

People overshare. Practically speaking, it's human. But the adversary is collecting information regarding your people — and social media is the easiest vector Took long enough..

• LinkedIn: "Excited to announce I'm leading the cloud migration for [Company]!" → Adversary now knows: migration underway, likely hybrid cloud, identity of project lead, approximate timeline.
• Twitter/X: "Late night debugging the new payment gateway integration 😅" → Tech stack hint, project phase, potential vulnerability window.
• Instagram: Team lunch photo. Badge visible. Whiteboard in background with sprint goals. Geotag confirms office location.
• Strava/Fitness apps: Heatmaps around secure facilities. Patrol routes. Shift changes. This actually happened — a fitness app heatmap revealed patrol patterns at a military base.

Metadata — The Invisible Leak

Every file you create carries hidden data. Timestamps. EXIF in photos. Day to day, revision history in PDFs. GPS coordinates. Author fields in Word docs. Software versions.

A marketing PDF uploaded to your public site might reveal: internal username, server path, Adobe version (with known CVEs), creation date that correlates with a product launch.

Adversaries automate metadata extraction at scale. Practically speaking, they don't read your documents. Their scripts do.

Physical Collection — Still Works

Dumpster diving isn't a joke. Think about it: shredded documents can be reconstructed. On top of that, badge photos cloned. Even so, tailgating into buildings. But shoulder surfing in airports. RF signal capture from wireless keyboards. Acoustic analysis of keystrokes.

The adversary is collecting information regarding your physical security posture — and most companies spend 99% of their budget on digital.

Supply Chain and Third-Party Leaks

You can be perfect. Your cloud backup vendor isn't. Even so, your law firm isn't. Your payroll provider isn't. Your conference swag supplier isn't.

The 2020 SolarWinds compromise wasn't a direct attack on target organizations. It was an attack on their vendor's build pipeline. The

The 2020 SolarWinds compromise wasn’t a direct assault on the target organizations; it was an attack on their vendor’s build pipeline. Worth adding: by compromising the software update mechanism of a widely used network‑management product, the threat actors gained a trusted foothold that could be leveraged against every customer that trusted the vendor’s code. The breach highlighted a sobering truth: the weakest link in any security chain is often the one you never even see And that's really what it comes down to..

Basically the bit that actually matters in practice.

How the Supply‑Chain Attack Unfolded

• Code signing certificates – The attackers obtained a valid code‑signing certificate, allowing malicious Orion payloads to appear legitimate.
• Automated distribution – The compromised updates were pushed to thousands of organizations automatically, bypassing perimeter defenses.
• Persistence through trust – Because the software was already whitelisted, the malware could operate under the radar for months, exfiltrating credentials and establishing back‑doors.
• Lateral movement via trusted services – Once inside, attackers leveraged the compromised tool’s privileged access to pivot to cloud environments, email, and critical data stores.

Why Third‑Party Risks Are Growing

1. Increasing reliance on SaaS and managed services – Companies outsource more functions than ever, expanding the attack surface beyond their own firewalls.
2. Complex vendor ecosystems – A single procurement may involve dozens of subcontractors (e.g., payroll processors, legal document custodians, conference‑swag printers), each a potential entry point.
3. Automation and CI/CD pipelines – Modern development pipelines pull code, libraries, and container images from external registries. A compromised dependency can infect every build.
4. Regulatory pressure – New frameworks (e.g., CMMC, ISO 27001, GDPR) mandate third‑party risk assessments, but many organizations still treat them as checkboxes rather than continuous monitoring.

Practical Mitigation Strategies

• Zero‑Trust Vendor Access – Treat every vendor’s service as an external entity. Enforce least‑privilege policies, multi‑factor authentication, and just‑in‑time (JIT) credential provisioning.
• Software Bill of Materials (SBOM) Management – Require vendors to provide SBOMs for all third‑party components. Automate scanning of those components for known vulnerabilities and malicious packages.
• Supply‑Chain Threat Intelligence – Integrate OSINT feeds that track vendor breach disclosures, compromised certificates, and suspicious code repositories. Tools like Maltego and theHarvester can map relationships between vendors, subdomains, and IP ranges to uncover hidden connections.
• Code‑Signing Certificate Verification – Validate that signing certificates belong to trusted publishers. Use certificate transparency logs and revocation checking before deploying updates.
• Continuous Vendor Assessment – Move beyond annual questionnaires. Conduct quarterly security reviews, pen‑tests, and automated vulnerability scans of vendor environments where possible.
• Network Segmentation and Micro‑Segmentation – Isolate vendor‑provided services from core corporate assets. Even if a vendor is compromised, the blast radius is contained.
• Incident‑Response Playbooks for Vendor Breaches – Pre‑define steps for rapid containment, forensic analysis, and communication when a partner is impacted by an incident.

Real‑World Lessons

• Accenture (2021) – A breach of a third‑party API provider exposed credentials for multiple client applications. The fallout forced Accenture to implement a comprehensive SBOM program and tighten API security controls.
• SolarWinds (2020‑2021) – The remediation effort cost billions and underscored the need for defense‑in‑depth across the entire supply chain, not just the primary perimeter.
• Kaseya (2021) – A ransomware attack on a managed‑service provider’s remote‑monitoring tool spread to hundreds of downstream businesses, illustrating how a single compromised tool can cascade across industries.

The Bottom Line

Your organization may be airtight, but the digital ecosystem you operate in is only as secure as its most vulnerable participant. Supply‑chain and third‑party risks are no longer optional considerations—they are central to any credible security posture. By leveraging OSINT tools, enforcing zero‑trust principles, and instituting continuous monitoring of vendor environments, you can shift from reactive firefighting to proactive resilience Surprisingly effective..

In the end, security is a collaborative effort. The next time you sign a contract with a new vendor, remember that the attacker’s playbook already includes that partnership. Treat every third‑party relationship as a potential attack vector, and build safeguards that protect both your digital and physical frontiers. Only then can you confirm that your defenses hold firm, no matter how far the supply chain extends.

People argue about this. Here's where I land on it.