The OSINT Investigation Cycle in Five Phases

Good OSINT work is no accident – it follows a recurring cycle that ensures no phase is skipped and results stay traceable.

1. Planning & objective

It all starts with the question: what exactly should be answered? A clearly defined objective prevents you from getting lost in side tracks. This is also where scope, legal basis and success criteria are set.

2. Collection

In this phase, information about entities – people, organisations, places, accounts – is gathered. It is essential to record every finding immediately with its source and timestamp, rather than laboriously reconstructing it later.

3. Processing & linking

Raw data is structured, duplicates are removed and relationships are made visible. A graph helps reveal connections between entities that stay hidden in a plain list.

4. Analysis

Now patterns are interpreted: sequences over time, spatial clusters, recurring links. The key questions are which findings are solid and where gaps remain. Contradictions are resolved deliberately.

5. Reporting

Finally, the results are summarised in a clear, verifiable report – including sources, methodology and open points. A good report is built so that others can follow the conclusions.

The cycle is iterative

In practice a finding often leads back to an earlier phase: a new connection calls for more collection, a gap for renewed analysis. It is exactly these loops that make an investigation complete.