Defensive OSINT is used to map what?

• A. Defensive OSINT maps your attack surface
• B. OSINT is only for competitor analysis
• C. Threat feeds map your attack surface
• D. Incident response playbooks

Answer: (A)

Defensive OSINT is about using publicly available information to uncover what an organization is exposing to the outside world. That exposure is the attack surface—the set of points where an attacker could interact with your systems. By gathering data from public sources about domains, IPs, subdomains, certificates, cloud assets, third‑party services, and even possible misconfigurations, you build a visibility map of what you own or rely on externally.

This helps you spot forgotten or unknown assets, shadow IT, and misconfigurations before attackers find them. It’s not just for competitor analysis, which is a separate use of OSINT. Threat feeds and indicators of compromise inform you about active threats, but mapping the attack surface is about inventorying and understanding your exposed assets. Incident response playbooks describe steps to take during incidents, not the process of discovering and mapping those assets.