Courses
OSINT courses, compared before you pay
A course is the expensive way to learn and the one most people finish. These write-ups cover delivery, labs, instructors, freshness, and certificates, so you can tell a six-day investment from a weekend one.
Before you choose
Five questions before you pay for a course
- 01
Does it make you do the work?
Watching someone search is not learning to search. Look for labs, scenarios, or graded exercises with real effort behind them.
- 02
Does the instructor still practise?
Platforms change monthly. Instructors who still run cases update their material; instructors who stopped in 2019 teach 2019.
- 03
When was it last updated?
Platform-specific content rots in 12 to 18 months. The course page should say when the material was last refreshed.
- 04
What does the certificate get you?
A few certifications are recognised by hiring managers. Most completion certificates are a line on LinkedIn. Pay for the skill, not the PDF.
- 05
Could a free option get you most of the way?
Free, self-guided programs cover the fundamentals well. Take one first, then pay for the course that teaches what you still cannot do.
Quick picks
If you only have time for one
Best free start
ReadOSINT Dojo
Self-guided, structured, and free, with a community attached.
Best when the employer pays
ReadSANS SEC497: Practical Open-Source Intelligence
The course hiring managers recognise, with a certification attached.
Best self-paced value
ReadMy OSINT Training
Practitioner-built, modular, and priced for individuals.
Best for realistic practice
ReadKase Scenarios
Full-length immersive cases instead of isolated tool demos.
Best for journalists and researchers
ReadBellingcat Workshops
Taught by the people whose investigations you have read.
Side by side
Every course at a glance
Cost is a model, not a price. Time is the commitment before it pays off. Updated is the latest edition or issue we could verify.
| Resource | Cost | Level | Time | Updated | Delivery | Certificate |
|---|---|---|---|---|---|---|
| OSINT DojoSinwindie, independent | Free | Beginner | WeeksSelf-paced. Each rank has a minimum time before you can advance, so the full path takes a year or more by design. | Live site, 2026; resource list partly dated | Self-guided tasks and quizzes | Verified digital badges per rank |
| My OSINT TrainingMicah Hoffman and Griffin Glynn | Free + paid | All levels | HoursFifteen minutes to four and a half hours per course. The core bundle is about sixteen hours; the full library is over fifty. | Catalogue maintained; a 2025 updates course exists | Self-paced video, one year of access | Not stated on the catalogue |
| Kase ScenariosEspen Ringstad, Aaron Roberts, and team | Free + paid | All levels | DaysA beginner scenario takes an evening or two; advanced ones take several days of real work. The provider does not publish hour counts. | New scenarios announced in 2026 | Self-paced scenario challenges | Not stated |
| Bellingcat WorkshopsBellingcat researchers | Paid | Intermediate | DaysOnline courses run four hours a day for two or three days. Deep dives are five full days in person. | New dates listed monthly through 2026 | Live online or in person | PDF certificate on request |
| SANS SEC497: Practical Open-Source IntelligenceMatt Edmondson, SANS Institute | Paid | Intermediate | DaysSix days in person or live online, or about 36 hours on demand with four months of access. | Scheduled through 2027; SEC487 retired after 2022 | 6 days live, or on demand | GIAC Open Source Intelligence (GOSI), separate exam |
| OSINT At HomeBenjamin Strick, Centre for Information Resilience FreeBeginnerArchived | Free | Beginner | HoursA few hours for the whole series, best spread over a week with practice between videos. | Videos from roughly 2020 to 2022 | Recorded video | None |
| Gralhix OSINT ExercisesSofia Santos | Free | All levels | HoursThirty minutes to a few hours per exercise depending on difficulty. Working through all 32 is a project of several weeks. | 32 exercises; latest added in 2025 | Text exercises with walkthroughs | None |
| TryHackMe OSINT roomsTryHackMe and community authors | Free + paid | Beginner | HoursThirty to sixty minutes per room. The free set is a weekend of work. | Topic page current in 2026; some rooms refreshed in 2024 | Guided browser rooms with flags | Room completion certificates on paid tiers |
| Introduction to OSINTCentri, formerly Security Blue Team | Free | Beginner | HoursAbout five hours. | Provider rebranded to Centri in 2026; course current | Self-paced online lessons | Completion certificate after the final exam, historically |
| Open-source Intelligence (Basel LEARN)Basel Institute on Governance, International Centre for Asset Recovery | Free | Beginner | HoursShort sessions you can spread over a week or two. The institute does not publish a total hour count. | Launched 2022; still listed in 2026 | Interactive eLearning around one case | Certificate of completion after the final report |
| OSINT FundamentalsHeath Adams, TCM Security Academy | Paid | Beginner | HoursNine hours of video. Plan a weekend or two with the lab exercises. | Academy platform current in 2026; course update date not stated | Self-paced video with labs | Completion certificate; separate practical exam (PORP) |
| SANS SEC587: Advanced Open-Source IntelligenceMatt Edmondson, SANS Institute | Paid | Advanced | DaysSix days live, or about 36 hours on demand with four months of access. | Major overhaul December 2024; scheduled into 2027 | 6 days live, or on demand | GIAC Strategic OSINT Analyst (GSOA), hands-on exam |
| IntelTechniques Online OSINT TrainingMichael Bazzell and team, IntelTechniques | Paid | All levels | WeeksOver a hundred hours of video. Plan months, not a weekend. | New videos monthly; pricing updated 2026 | Self-paced video and PDF manual | OSIP, a 10-day practical mission, separate fee |
| OSINT Combine AcademyOSINT Combine, now part of Kaseware | Paid | All levels | HoursHour counts per course are not published. Expect an evening to a weekend per module. | Catalogue re-priced into modules; new AI courses 2026 | Self-paced video, 12 months access; some live | Certificate of completion per course |
| Toddington International OSINT TrainingToddington International, Canada | Paid | All levels | WeeksLive courses are two full days. Self-paced courses range from twenty to seventy hours each. | Live dates through early 2027; e-learning update dates not stated | 2-day live remote, or self-paced e-learning | Not stated on course pages |
| DFRLab Digital SherlocksDigital Forensic Research Lab, Atlantic Council | Free | Intermediate | WeeksAbout three months, with two to three live sessions a week and a minimum attendance for the certificate. | 2026 cohort running; applications closed in May 2026 | Live online cohort | Yes, with minimum attendance |
FAQ
Questions, answered
Do I need a paid course to work in OSINT?
No. Plenty of working analysts learned from free programs, books, and CTFs. A paid course buys structure, feedback, and speed, and sometimes a certification an employer asks for.
Which OSINT certification is worth having?
The GIAC Open Source Intelligence certification tied to SANS SEC497 is the one most often named in job listings. Most other certificates show effort rather than open doors. Choose the course for its content first.
How long does it take to get competent?
With steady practice, a few months to be useful on simple cases and a year or more to be trusted with hard ones. Courses compress the first part; nothing compresses the second.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days