Planning an OSINT Workshop: Goals, Duration, Group Size and Prerequisites

“Participants should understand OSINT” names a subject, not an observable learning outcome. A useful brief describes a later task: turn a question into a research plan, assess sources, verify media or document a finding so another person can review it.

The NIST NICE distinction between tasks, knowledge and skills is useful here. A talk can transfer knowledge; a workshop should also let participants perform a task and receive feedback.

Communications, corporate security, compliance and specialist research teams need different examples. Experience can also vary widely within one organisation.

The brief should establish roles, later tasks, current research experience, organisational rules, language and accessibility needs. Mixed groups often benefit from a common foundation followed by differentiated exercises.

• Which roles will attend?
• Which tasks will they perform later?
• What research and verification experience already exists?
• Which legal, organisational or technical limits apply?
• Which language and accessibility requirements matter?

The more practical work, individual feedback and shared review a workshop requires, the more time or facilitation capacity it needs.

A half day fits one bounded topic and a compact exercise. One day can cover foundations and a full methodological cycle. Two or three days, or modular delivery, create room for repeated practice, feedback and transfer.

The interactive formats described here generally use groups of approximately six to sixteen people depending on the module. This is a practical planning range, not a universal research standard.

Technical preparation should follow the learning goal rather than a generic tool list. Depending on the format, participants may need laptops, current browsers, reliable internet, approved services, small-group space and a way to present findings.

Real targets, applicant data, operational cases and confidential documents should not be introduced spontaneously. Use synthetic, authorised or specifically prepared material. Where sensitive data is necessary, purpose, lawful basis, access, retention and deletion must be agreed first.

• Test access from the organisation’s network
• Agree accounts and temporary access
• Prepare non-sensitive exercise material
• Document privacy safeguards and exclusions

An initial concept normally needs the occasion, participant roles and number, existing knowledge, intended later tasks, available time, technical constraints, sensitive exclusions and the intended form of transfer.

That is enough to choose between foundations, a verification lab, a digital-exposure format or a modular capability-building approach.

1. 01
   Task

   Define the intended action and work product.

2. 02
   People

   Clarify roles, experience, group size and access needs.

3. 03
   Environment

   Set time, technology, data and permissible methods.

4. 04
   Transfer

   Connect exercises and feedback to later work.

Attendance is not evidence of capability. A research plan, source assessment, verification record or concise finding with visible uncertainty provides a more useful signal.

An OSINT workshop is not legal advice or permission for unrestricted research about people. It does not replace internal privacy, compliance or approval processes. Sustained capability also requires repeated practice, roles and quality assurance.

• Does each claim remain connected to a source?
• Are observation, assessment and hypothesis separate?
• Were alternative explanations considered?
• Can another person reproduce the reasoning?