Blogs

Blog

The Evolution of the Geotag: How AI is Bridging the Gap in Location-Based OSINT

In this post, we explore how the decline of geotagged data is reshaping location-based OSINT, the intelligence gaps it creates for analysts, and how AI-driven keyword generation and geofencing are restoring visibility into real-world events.

For years, location-based open-source intelligence (OSINT) has relied heavily on a steady stream of user-generated geographic data. Geotagged social media posts with embedded latitude and longitude coordinates have long been a goldmine for tracking regional trends, monitoring real-time events, and understanding on-the-ground public sentiment. Intelligence professionals and data scientists have historically used this passively-generated location-based data to aggregate real-time insights for everything from tracking public sentiment to monitoring natural disasters.

However, the era of effortless geographic tracking is coming to an end. Geotagged social media data is becoming increasingly scarce, making it significantly harder for security teams to gather a complete picture of location-based intelligence.

The Decline of Location Sharing

The primary driver behind the diminishing use of geotags is a massive shift in digital privacy standards. For instance, major platform-level policy interventions, such as Apple’s November 2021 iOS privacy update, changed the default consent model for device tracking. Instead of requiring users to actively opt out of location tracking, iPhone users must now explicitly opt in.

As a result of these strengthened privacy controls, a massive behavioral shift occurred: within a year of the iOS update, 62% of affected users chose to opt out of location tracking entirely. This platform-mediated behavioral barrier has drastically reduced the availability and visibility of granular location traces, creating complex new blind spots for researchers and intelligence analysts.

The Intelligence Gap

With precise coordinates disappearing from social feeds, security practitioners and OSINT investigators are left facing a major data void. Relying purely on traditional keyword or hashtag searches to find location-specific events is highly inefficient. In fact, as little as 7% of social media posts actually contain hashtags. If an analyst is scanning 10,000 posts a day looking for a specific hashtag, they could be missing up to 9,300 posts that hold critical intelligence.

To compensate for missing geotags, security practitioners have traditionally had to spend valuable time performing manual, tedious searches for specific local details like street names, landmarks, and local businesses to figure out where an event is taking place.

Bridging the Gap with AI

To overcome the increasing scarcity of explicit location data, the intelligence industry is leveraging artificial intelligence and spatial technologies.

AI-powered keyword optimization tools like Echosec’s new AI-powered “Optimize” feature are designed specifically to bridge this data gap. Instead of relying on users to share their precise coordinates, AI automatically generates hyper-relevant, location-based keywords for an investigator’s search. If an analyst is looking into a specific neighborhood, the AI will suggest relevant landmarks, tourist attractions, schools, government buildings, and businesses to monitor. This instantly converts manual, time-consuming research into an automated process, significantly increasing the volume and relevance of the data collected.

Geo-Based OSINT 2.0

Geo-based search combined with AI keyword generation is taking OSINT to the next level. Geofencing allows teams to draw virtual perimeters around physical sites, such as corporate offices, foreign meeting sites, or public gatherings, to monitor digital activity strictly within those areas. This means you don’t need to know what keywords or hashtags you are looking for; you only need to know where to look. This is incredibly valuable for real-time executive protection and monitoring civil unrest, as it surfaces visual intelligence and early warnings directly from the scene, cutting out irrelevant noise.

The Future of OSINT for Situational Awareness

The decline of the geotag is a victory for consumer privacy, but it isn’t the end of location-based intelligence. By leveraging AI-driven keywords and hyper-local geofencing, security teams can move beyond broad geographic searches. These smart tools alleviate research bottlenecks, allowing analysts to redirect their expertise away from exhaustive data hunting and toward the critical analysis needed to respond to threats before they escalate. The geotag may be fading, but our situational awareness remains sharper than ever.

Don’t let the intelligence gap compromise your situational awareness. Ready to move from tedious manual searches to immediate, actionable insights? Book your Echosec demo today and empower your team with the next generation of location-based insight.

Request a demo today.

Blogs

Blog

The Human Element: Turning Threat Actor OPSEC Fails into Investigative Breakthroughs

In this post, we explore how the psychological traps of operational security can unmask even the most sophisticated actors.

The threat intelligence landscape is often dominated with talks of sophisticated TTPs (tactics, tools, and procedures), zero-day vulnerabilities, and ransomware. While these technical threats are formidable, they are still managed by human beings, and it is the human element that often provides the most critical breakthroughs in attributing these attacks and de-anonymizing the threat actors behind them.

In our latest webinar, “OPSEC Fails: The Secret Weapon for People-Centric OSINT”,  Flashpoint was joined by Joshua Richards, founder of OSINT Praxis. Josh shared an intriguing case study where an attacker’s digital breadcrumbs led to a life-saving intervention. 

Here is how OSINT techniques, leveraged by Flashpoint’s expansive data capabilities, can dismantle illegal threat actor campaigns by turning a technical investigation into a human one.

Leveraging OPSEC as a Mindset

In a technical context, OPSEC is a risk management process that identifies seemingly innocuous pieces of information that, when gathered by an adversary, could be pieced together to reveal a larger, sensitive picture.

In the webinar, we break down the OPSEC mindset into three core pillars that every practitioner, and threat actor, must navigate. When these pillars fail, the investigation begins.

• Analyzing the Signature: Every human has a digital signature, such as the way they type (stylometry), the times they are active, and the tools they prefer.
• Identity Masking & Persona Management: This involves ensuring that your investigative identity has zero overlap with your real life. A common failure includes using the same browser for personal use and investigative research, which allows cookies to bridge the two identities.
• Traffic Obfuscation: Even with a VPN, certain behaviors such as posting on a dark web forum and then using that same connection to check personal banking can expose an IP address, linking it to a practitioner or threat actor.

“Effective OPSEC isn’t about the tools you use; it’s about what breadcrumbs you are leaving behind that hackers, investigation subjects, or literally anyone could find about you.”

Joshua Richards, founder of Osint Praxis

Leveraging the Mindset for CTI

Understanding the OPSEC mindset allows security teams to think like the target. When we know the psychological traps attackers fall in, we know exactly where to look for their mistakes.

Assumption	The Mindset Trap	The Investigative Reality
Insignificant	“I’m not a high-value target; no one is looking for me.”	Automated Aggression: Hackers use scripts to scan millions of accounts. You aren’t “chosen”; you are “discovered” via automation.
Invisible	“I don’t have a LinkedIn or X account, so I don’t have a footprint.”	Shadow Data: Public birth records, property taxes, and historical data breaches create a footprint you didn’t even build yourself.
Invincible	“I have 2FA and complex passwords; I’m unhackable.”	Session Hijacking: Infostealer malware steals “session tokens” (cookies). This allows an actor to be you in a browser without ever needing your 2FA code.

During the webinar, Joshua shares a masterclass in how leveraging these concepts can turn a vague dark web threat into a real-world arrest. Check out the on-demand webinar to see exactly how the investigation started on Torum, a dark web forum, and ended with an arrest that saved the lives of two individuals.

Turn the Tables Using Flashpoint

The insights shared in this session powerfully illustrate that even the most dangerous threat actors are rarely as anonymous as they believe. Their downfall isn’t usually a failure of their technical prowess, but a failure of their mindset. By understanding these OSINT techniques, intelligence practitioners can transform a sea of digital noise into a clear path toward attribution.

The most effective way to dismantle threats is to bridge the gap between technical indicators and human behavior. Whether your teams are conducting high-stakes OSINT or protecting your own organization’s digital footprint, every breadcrumb counts. By leveraging Flashpoint’s expansive threat intelligence collections and real-time data, you can stay one step ahead of adversaries. Request a demo to learn more.

Request a demo today.

Blogs

Blog

Beyond Gates and Alarms: The Scope and Impact of Physical Security Intelligence

Exploring the role of physical security intelligence, which helps governments and commercial enterprises keep people, places, and assets safe

What is Physical Security Intelligence?

When most people think of physical security, they often think about access control measures or physical security systems. These include gates, alarms, surveillance cameras, and security guards. These measures are fundamental to protecting facilities, as well as the people, assets, and infrastructure inside of them. However, these measures fail to address several external factors. These factors include the impact of natural disasters, terrorist attacks, and insider threats on physical security.

Why is Physical Security Intelligence Important?

That is where physical security intelligence comes into play. Physical security intelligence delivers mission-critical insights into real-time situations occurring globally. It empowers governments and commercial enterprises to safeguard, defend, and enhance the security of individuals, locations, and physical assets.

Physical security intelligence is built on external information. This includes social media and other online channels. It provides situational awareness and insights into potential physical security threats in their earliest stages.

Where Physical and Cyber Threat Intelligence Collide

Cyber and physical threats are increasingly related. In fact, most attacks on people, places, and infrastructure involve some degree of online communication. Real-world events are often enabled or bolstered by cyber-related activities. An example is when a threat actor uses an online discussion forum or social media network to plan a physical attack.

Decentralized open-source channels like Telegram have become an increasingly popular medium for both cyber and physical threat actors. These channels have eroded long-standing barriers to entry to the deep and dark web. When that communication takes place in publicly available channels, security teams can use that information to investigate the incident. Ideally, they can be alerted to early warning indicators and prevent it altogether.

The Impact of Open-Source Intelligence (OSINT)

Physical security intelligence reduces information gaps and leads to more proactive physical security. Open-source intelligence is a critical resource for these applications.

OSINT involves gathering and analyzing publicly available information to derive meaningful insights. In recent years, OSINT has become one of the most relied-upon forms of intelligence for the US government. Its abundance and low barrier to entry make OSINT increasingly useful for commercial enterprises as well.

Thanks to the smartphone, open sources like social media often provide the most up-to-the-minute information about breaking events. Tapping into this data gives security and intelligence teams the real-time information necessary for addressing immediate crises and generating timely intelligence. OSINT provides incredible value for both public and private sector teams. This is true as long as they have the tools and capabilities to gather and analyze the abundance of information effectively.

Examples of Physical Security Intelligence Use Cases

How understanding physical risk can enable corporate physical security teams and public sector organizations to address a wide range of challenges.

Global Situational Awareness

Open-source data can improve situational awareness. It does this by providing insight related to geopolitics, public sentiment, technology developments, and on-the-ground activities in areas of interest. This is especially true when that data is enriched with geospatial information. This information includes where the posts originated, or what locations were mentioned within the post contents and metadata.

Crisis Response

Open-source data provides real-time information for events like natural disasters, public health crises, and terrorist attacks. This information helps security teams stay alert to breaking events, assess impacts, and respond appropriately.

Executive Protection and Force Protection 

Across the public and private sectors, threats to personnel come from all directions. This ranges from unforeseen travel risks to doxing and reputational risks, such as bad press. Leveraging OSINT is crucial for surfacing this information and reducing blind spots. It is a strategic complement to traditional executive protection methods like bodyguards and security cameras.

Flashpoint Ignite equips physical security teams with real-time access to the most extensive breadth of open-source information available.

Persistent Threat Analysis

Persistent security concerns like terrorism rely on social media and other online channels to spread. OSINT helps physical security and intelligence teams monitor evolving web-based chatter to improve visibility and defend against those threats.

Insider Threats

Social dissent, burnout, and various other factors have dramatically shifted the insider threat landscape. Disgruntled employees may take action against organizations. This could include disclosing confidential data or disrupting business operations. They often discuss these topics online before taking action. Government, healthcare, big tech, and media are especially vulnerable.

Physical Attacks

Social media and discussion websites are often used to share violent intent and plan events. For example, the Capitol Hill insurrection was planned online for weeks prior to the attack. Bad actors tend to be more candid in online settings. This is because their identity is anonymous, and they are engaging with like-minded communities.

Supply Chain Disruptions

Disruptions like natural disasters or geopolitical conflicts can halt or delay the flow of goods along the supply chain. Monitoring open sources for these disruptions can provide early warning indicators. It can also help you assess if your organization will be impacted down the line.

Event Monitoring

It is vital to have the right physical security intelligence protocols in place. This ensures the security of an event and its attendees. Physical security intelligence can augment an organization’s overall security and intelligence operations during an event. This could be a high-profile conference with global attendees or a smaller affair. Physical security intelligence can include pre-event assessments, daily stand-ups, and monitoring and alerting of imminent and potential threats. Protecting a location—and the people around it—is also essential to strengthening brand reputation

Flashpoint Ignite for Physical Security Teams

Flashpoint’s Physical Security Intelligence (PSI) solution is part of the Ignite platform. It gathers open-source data from a variety of online spaces. These range from mainstream social media, discussion forums, fringe networks, messaging apps, and regional sources from around the world. The solution is fast and intuitive. It allows users to search, filter, monitor, and analyze the data in a customizable dashboard. User-generated alerts ensure that the right team gets notified if new, relevant content is detected. Enrichments like geolocation, language detection, and threat detection provide valuable context to the information discovered.

Request a demo today.

Request a demo today.