Introduction
I have now been teaching open-source intelligence (OSINT) for seven years, to a varied audience (students, professionals, geeks, private detectives, and others), in a range of formats (one day, three days, ten days, and so on) and with diverse objectives. Since 2019, the tools have evolved enormously… and so has my way of approaching the teaching of the discipline. This text stems from a reflection on those years of teaching and on the methods I have used.
It seems useful first to recall that OSINT is not merely the collection of information from open sources: it is an analytical methodology aimed at answering a given question as precisely as possible. It is therefore only within that restrictive framework that an analyst collects information. Training an analyst is thus not a matter of training someone able to find a piece of information; it is training someone who knows how to determine what they need to find, how to go about it, how to analyse what they collect, and how to interpret the absence of a result — the absence of information or the existence of grey areas being inherent to the profession.
The thesis I set out in this paper can be reduced to three propositions. First, while teaching OSINT through a breakdown into thematic modules does indeed convey the collection techniques used for intelligence purposes, it prevents sufficient attention being paid to an essential dimension of investigation: the management of uncertainty. Second, it is possible to organise a course without following a predetermined path: conducting an investigation dynamically, following the learners' own thinking as the programme unfolds, makes it possible to convey the uncertainty an investigator faces. This takes the form of learning through live investigation: the class takes place on a projected browser, where the teacher follows the leads suggested by the students. The slides are not shown, even if a set of materials is provided at the end of the session. Third, this method does not suit every audience: it aims to train analysts, not to equip professionals who have no calling to investigate or who, on the contrary, are already familiar with the investigative process. The question "whom are we teaching, and why?" must therefore be settled before deciding on the approach to adopt.
The aim here is not to demonstrate experimentally the superiority of this method, but to formalise a teaching approach drawn from practice and to show its consistency with certain work on the learning of complex skills.
What modular teaching tends to neutralise
An effective format for technique
In 2019, when the time came to design an OSINT training programme, a small group of us tried to answer the following question: "what must a future OSINT analyst master?", and, consequently, how should the course be organised? We fairly quickly agreed that a good analyst had, above all, to master the methodology, then search engines, archives, Whois lookups, social media, and so on (the list could be longer). The aim here was to train students in their early twenties, so that they would be able to find information useful for their future academic projects, within a school specialising in competitive intelligence. This breakdown into modules has several advantages: it gives students a clear direction, allows them to progress step by step, and makes it easier to acquire new techniques. From a teaching standpoint, it is also easier to assess.
The problem is not what the module teaches, but what it tends to neutralise: the management of uncertainty and the constant formulation of new hypotheses, two notions essential to investigation.
The erasure of part of the uncertainty
In a real investigation, indeed, the analyst is guided by the question put to them, then by the questions they ask themselves and the research hypotheses they formulate. Faced with an initial question (assessing the reputation of an individual or organisation, identifying a potential conflict of interest, locating a person, and so on), it falls to them to determine which resources to draw on and which techniques to employ in order to reach the most reliable possible answer. It also falls to them, throughout the research process, to consider the reliability of the information and the best way to use it.
Modular teaching, however, reduces this preliminary work of reflection by prescribing part of the path to be taken. If, within the module devoted to search engines, students are asked to assess a company's reputation, they will naturally be steered towards consulting Google/Bing/Yandex with suitable keywords and operators. In an investigation, no such steer exists, and a decisive element might be found in the archives, in a non-indexed database, or on the executive's social media. The information sought may also be untraceable in open sources, or may not exist at all. An exercise set within a module therefore reflects this uncertainty imperfectly, since its framing already points to part of the relevant search space.
Learning from failure through problem-solving offers an interesting parallel with the teaching of OSINT. If a player faces a chessboard with the sole instruction to play, they must work out for themselves what the best combination is, without knowing whether they will ultimately win a piece or merely improve their position. If that same player is told that a combination allows them to capture a knight, then half the problem — the uncertainty about which line to follow — is already solved. This is the pitfall produced by teaching that is too heavily guided: the module tells the student that the combination lies in the archives, or in the companies register. The answer is not given, but the learner already knows where to look and is therefore not placed in real conditions.
Two forms of uncertainty to distinguish
During an investigation, uncertainty takes two forms that do not pose the same pedagogical problem.
The first is epistemic and concerns the value of the information collected. Information may indeed be (deliberately) false or erroneous, out of date, or accurate but worthless. What is required here is the classic work of intelligence analysis: assessing sources, cross-checking, and guarding against one's own cognitive biases (Heuer, 1999) in order to gauge the relevance and reliability of the information. For this stage, modular teaching is well suited.
The second is procedural and concerns the action to be taken at each stage in order to move the investigation forward. At the outset of an inquiry, it is a matter of opening a first lead. Then, within that lead, of determining all the relevant elements, all the questions they raise, the leads they open and those they close. This form of uncertainty comes fully into play when the learner is faced with a wholly open field, without knowing which module the answer falls under, or even whether an answer exists.
It is this management of uncertainty that modular teaching tends to eliminate when it predetermines the search space: the breakdown then tells the learner which family of resources or techniques is relevant before they have even had to choose it. It does not necessarily remove the uncertainty, but it narrows the range of possibilities open to the learner. Yet the ability to handle this multiplicity of leads is what characterises the OSINT analyst's craft.
A mindset that cannot be broken into parts
What an intelligence analyst has to acquire is a mindset, a methodology: observe, formulate a hypothesis, search, note the result or its absence, revise, pivot. This mindset is not acquired by learning procedures, but through experience. Gary Klein's work on decision-making in real-world settings (firefighters, the military, and so on) shows that, in many situations, the expert does not carry out an exhaustive comparison between several options: they recognise familiar configurations, and this recognition comes from repeated exposure to whole situations, with their ambiguities, rather than to fragments (Klein, 1998). Van Merriënboer and Kirschner (2018) reach the same conclusion regarding training in complex skills: learning transfers better when it addresses whole tasks of increasing difficulty than when it is fragmented into pieces that the learner must then reassemble alone.
Take an example: assuming the fictitious email address joshua.knd90@gmail.com exists, what are all the searches one could carry out in order to gather as much information as possible about its owner?
An email address constitutes a particularly rich investigative pivot: it is often linked to dozens of services and to social media accounts, and it has a history… From an email address, a seasoned analyst will thus follow leads (querying databases, checking whether it is associated with the registration of a domain name, retrieving a profile picture and any Google Maps reviews, and so on), but will also open up hypotheses: joshua.knd90 is an unusual local part — could it be a pseudonym? In that case, one should consult a service capable of identifying a username across several hundred social networks. Might there be email addresses in Hotmail, Yahoo, and other formats? And, if so, it will be necessary to bear in mind that this could be a false positive. After all, two people may use the same username, however unusual it is.
A modular programme would teach each of these techniques separately: reverse email lookup in one session, username searching in another, Whois in a third. But the breakdown into modules does not, on its own, teach the decision to chain them together, the order in which to do so, or the formulation of hypotheses that trigger new searches. Yet it is this decision-making capacity that distinguishes an analyst from an operative. By contrast, live investigation makes it possible to embed this methodology, because the learners run through the complete loop (observe, formulate a hypothesis, search, note the result, pivot) with each new lead, instead of working through its steps separately.
Running the investigation live rather than clicking through slides
The experiment
At the start of the 2025 academic year, I had the opportunity, for the first time, to teach students beginning a three-to-five-year programme, with OSINT classes each semester. This new cohort offered a twofold advantage: a fresh eye on investigation, and the possibility of working over the long term. The aim, with them, is to turn them into analysts. Accustomed to module-based teaching, I tried out a different arrangement.
Having laid down the indispensable foundations (the general methodology of research and the mastery of search engines), the course was then built around a concrete case: carrying out due diligence on a company while stepping into the shoes of a firm looking to acquire it. The class then unfolded live on a projected browser, driven by the students' own questions, in semi-autonomy. The point was not to teach them the right tool or the right path to follow, but to discuss the soundness of their intuitions. Some wanted to start with social media, others with the companies register, a third group with the website. Each time, the same question: "What do you expect to find by looking at that?"
The "live" character is not, however, an end in itself: the central principle is to organise the learning around a complete investigative task, in which the technical building blocks are introduced at the moment a lead makes them necessary. The projected browser is the device that makes the choices, the hesitations, and the successive pivots visible.
In the example studied, analysing social media proved unpromising and was therefore set aside for later. On the other hand, the idea of consulting the companies register imposed itself, since it is a bedrock that allows an investigation to begin with reliable information. It was once on the companies register that I introduced a first theoretical block, to show them the specific features of the French register and the information that can be gathered from this type of source through the articles of association, the annual accounts, and so on. In the same logic, analysing the website led us to consult the web archives, prompting the study of a second theoretical block on how archive.org works. Once the rudiments of the tool had been grasped, the session moved on to analysing what the archives can offer: the point was then not to understand how a tool works and what it does technically (consulting older versions of a site), but what it can concretely contribute within an investigation, why it is useful to look at a version five or ten years old. Here, digging through the archives made it possible to identify former subsidiaries. Questioning the students about the significance of such information pushed them to understand that a subsidiary might have closed for reasons it was important to clarify (an economic choice, tensions, scandals, and so on).
Conversely, some promising leads yield nothing. It is nonetheless essential to follow them, because, in training, method and reasoning take precedence over the final result. Since a genuine investigation is marked by numerous dead ends, tackling them during training becomes a lesson in itself. In the case studied, no reason could be established for the closure of one of the foreign subsidiaries, which made it possible to raise new questions: is the information really useful? If so, what means should be deployed to find the answer? Does the absence of an answer constitute a warning sign? These three questions remained open: in a real report, this grey area would be resolved by other means or flagged as such. This presupposes, however, that the case rests on a real situation. When the teacher fabricates a case, they know an answer exists, and the students know it too: we are back to the chess bias of the announced combination. Confident that there is something to find, they search until they find it, instead of questioning the relevance of the lead or the very existence of an answer.
It is all this work, in semi-autonomy, that adds value: the student has to prioritise leads, formulate hypotheses, accept that a search yields nothing, and decide when to pivot. The goal is not merely to learn how to find information, but to conduct an inquiry marked by uncertainty.
Guiding the reasoning, not the answer
To convey this research logic, the teacher must be flexible and adapt to the students' thinking. It is not, however, a matter of leaving beginners to fend for themselves. Indeed, minimal guidance imposed on novices fails because managing the search itself saturates their working memory and leaves nothing over for learning (Kirschner, Sweller & Clark, 2006). Guidance is therefore necessary, but it must bear on the reasoning and not on the answer, which is why one must constantly ask learners what they hope to get out of each action they propose. The teacher rules out leads while explaining why, favours others, gradually tightens the hints if the group gets bogged down, and provides the lead only as a last resort. It is this scaffolding that distinguishes a well-run problem-based method from the minimal guidance criticised by certain researchers, such as Kirschner and his colleagues (Hmelo-Silver, Duncan & Chinn, 2007).
It is also particularly useful for the exercise to be conducted live, on the web browser. Unlike a sequence of slides, this method makes it possible to convey the dynamics of an investigation and shows that an inquiry is never linear. It also introduces the notion of serendipity: a discovery may be fortuitous, but one must still know how to recognise its value and incorporate it into one's reasoning. Within an investigation, the investigator's experience increases precisely their ability to identify, among unexpected signals, those that warrant opening a new lead.
Following a lead live also makes it possible to convey the many failures that punctuate an investigation: a query that yields nothing and is reformulated in front of the class, a line of inquiry abandoned with an explanation of why, a database that fails to respond, and so on. These dead ends never appear on slides prepared in advance, which retain only what worked. Yet failures are just as instructive as successes when it comes to learning.
In the educational sciences, this method comes close to cognitive apprenticeship, in which the teacher begins by demonstrating their own reasoning, then supports that of the learner, and gradually fades away as autonomy takes hold (Collins, Brown & Newman, 1989). In the end, this method makes it possible to cover the same theoretical blocks as a modular programme, but they are delivered at the moment a lead makes them necessary.
The modular model followed by case studies
Integrating case studies within each module only partly solves the problem, since these cases inherit the module's framing and steer learners towards a particular family of techniques. A supporter of the modular method might, however, object that it is enough to integrate case studies not at the end of each module, but once all the modules have been studied. In this way, learners would be confronted with the uncertainty of research while possessing a theoretical grounding enabling them to grasp the different spaces of the web.
To my mind, relegating investigation to the end of the course is not the same as teaching it repeatedly. The learners are, in theory, well equipped, but they have had little exposure to investigation and its uncertainties. Yet, as noted in 2.2, minimal guidance fails with novices. By offering open investigations only at the end of the training, one limits the number of observe-hypothesise-search-pivot loops to which learners are exposed, whereas live investigation makes it possible to repeat them with every new lead. It is over the course of these repetitions that the recognition of situations is learned and that reflexes are honed.
Limits and conclusion
The live investigation as described here is not easy, because it requires several prerequisites: first of all time, since the exchanges, the repetitions, and the false leads form an essential pillar of the learning. In addition, experience shows that the cognitive load is heavy for learners, who are discovering many tools while also having to internalise a methodology. It is therefore not realistic to compress the learning into a few days. Spacing the sessions out over several weeks, with practical exercises to be carried out independently, is necessary in order to internalise the new knowledge and let the thinking mature. This method further requires a certain flexibility on the trainer's part, who cannot simply work through a set plan.
Nor is live investigation suited to everyone. As noted in 2.1, it is aimed at an audience intending to become analysts, not necessarily at an audience simply wishing to improve their information-research skills. For a professional in search of new knowledge, the modular format, backed by case studies, seems more appropriate, since the objective may be less to build an analyst's mindset than to enrich an already structured repertoire of methods and tools. Research on the expertise reversal effect confirms this: the supports that serve novices become redundant, even counterproductive, for learners who already possess the schemas those supports seek to build (Kalyuga, Ayres, Chandler & Sweller, 2003).
The modular format is therefore not to be abandoned: it remains particularly effective for conveying a technique and relevant for already-trained professionals. But used on its own, or followed by investigations relegated to the end of the programme, it exposes future analysts insufficiently to procedural uncertainty — the uncertainty concerning which lead to follow, which is the daily reality of the profession. Live investigation, with an initial grounding and explicit guidance, confronts learners with this uncertainty from the very first sessions, without overwhelming them.