Ordered, not random
A clear sequence — foundations → people → infrastructure → leaks → desk craft — so you build judgment instead of hopping between tip videos.
← Resources
Curated learning path
What to study next in OSINT — in a sensible order
We don’t own these materials. OSINTverse curates them so it’s easier to learn and improve OSINT skills. Credit stays with the original authors, publishers, and communities.
How this path is meant to work
Ordered study, optional practice, and pointers into books and communities we curated elsewhere.
Practice on a real desk
When you are ready to apply a step, SearchIn lets you run the same provider types investigators use day to day.
Pointed at the wider field
Pair each focus area with books, newsletters, and communities we curated elsewhere in Resources — we do not claim to own those sources.
Focus areas
Suggested OSINT study order
Follow the sequence, or jump to the focus area that matches your current case work. Materials you study along the way belong to their authors.
Focus 1
01
OSINT foundations and ethics
What counts as open-source intelligence, legal boundaries, source hygiene, and how to document findings for someone else to reproduce.
- Define tasking and success criteria before you search
- Separate collection from analysis in your notes
- Know when to stop and escalate
Focus 2
02
People and identity collection
Username, email, phone, and face pivots — how to chain public and commercial sources without drowning in noise.
- Build a person dossier from sparse seeds
- Validate matches across providers
- Avoid false positives from recycled handles
Focus 3
03
Infrastructure and surface mapping
Domains, WHOIS history, DNS, hosting, and Shodan-style exposure — mapping an organisation without guessing.
- Timeline a domain ownership story
- Connect infrastructure to people and brands
- Prioritise exposures that matter to the case
Focus 4
04
Breach and stealer intelligence
Working with breach corpora and stealer logs responsibly — querying, correlating, and writing findings that survive review.
- Query LeakRadar / Snusbase-class sources with intent
- Correlate emails, passwords, and hosts
- Phrase findings for legal and security audiences
Focus 5
05
The modern OSINT desk
Cases, notes, pivots, and automation — how a repeatable investigation loop looks when you move from tutorials into production work.
- Run a multi-provider case end to end
- Export and brief without losing context
- Know when UI search vs API automation is right
Who this learning path helps
Roles that benefit from a sequenced skill map instead of random tutorials.
- Private investigators and corporate investigators
- SOC / CTI analysts expanding beyond SIEM alerts
- Journalists and researchers verifying digital claims
- Students moving from theory to paid-provider workflows
Prefer industry playbooks? See OSINT guides or use cases.
Frequently asked questions
- Is this an OSINTverse course I can enroll in?
- No. This page is a curated learning path — a suggested order of skills. We do not sell or host a proprietary course here. Use the books, guides, newsletters, and communities we list to learn, then practice on tools you choose (including SearchIn if you want).
- Do I need SearchIn to follow this path?
- No. You can study methods with free and third-party materials alone. SearchIn is optional practice when you want paid-provider pivots on the same desk many teams use.
- How is a curated path different from YouTube tutorials?
- Tutorials are usually one trick at a time. This path sequences foundations → collection → infrastructure → leaks → desk craft so you know what to study next and why.
Next: books and communities we curated
This path only orders the skills. Use the reading list and communities directories for sources owned by others — then practice on SearchIn if you want.