How to Write an OSINT Report: Findings, Evidence and Confidence

Even the best research loses its value in a badly written report. If the reader cannot tell what you found, how you found it and how far they can trust it, the research might as well not have happened. This guide covers the structure of an OSINT report, how to log evidence and how to write about things you are not sure of.

Think about the reader first

Who will read the report, and what decision will they make with it? A hiring manager, an editor or a legal team need different details. But they all expect the same thing: to see the conclusion in the first paragraph, and then to be able to check how it was reached.

Report structure

1. Bottom line up front (summary): The research question and its answer, in a few sentences at most. A reader who reads only this section should still be able to decide.
2. Key findings: One finding per item, each with its confidence level.
3. Method: Which sources did you look at, which tools did you use, what was the scope of the research?
4. Evidence: The sources behind each finding: link, access date, archived copy, screenshot.
5. Limitations: What could you not look at, which question is still open, which finding rests on a single source?
6. Appendices: Timeline, map, link chart, raw data.

Evidence logging: every finding must be traceable

Open sources change: posts are deleted, pages are updated, accounts are closed. The reader must be able to see the evidence months later. So record a finding the moment you find it, not when you write the report.

• Link and date: The full address of the source and the date and time you accessed it (with the time zone).
• Archived copy: Save important pages to a web archive and put the archive link in the report.
• Screenshot: Uncropped, with the address bar and date visible.
• Original file: If you downloaded an image or document, keep the original and do not modify it.

Confidence: saying what you are not sure of

Most OSINT findings are not certain. Stating this openly instead of hiding it makes the report more trustworthy. For every important finding, say how confident you are and why.

• High: Several independent sources show the same thing and there is no conflicting evidence.
• Moderate: There are strong indications, but independent verification is missing or there are small inconsistencies.
• Low: It rests on a single source or an indirect inference; other explanations are possible.

Use words like “certainly” and “without doubt” only for things that really are certain. Use terms like “probably” and “likely” with the same meaning throughout the report; the same word should not mean 60% in one place and 90% in another.

Separate facts from interpretation

“The account was created in 2019” is a fact; “the account is fake” is an interpretation. Keep the two apart in the report: first write the observation with its source, then explain what you conclude from it and why. Even a reader who does not reach your conclusion can still use the observation.

Personal data and ethics

Include only information relevant to the research question. Leave out unrelated family details, addresses and special categories of personal data (such as health, religion or political opinion). Decide at the start who the report will be shared with; a report can do as much harm as the research itself.

A CTF write-up is a report too

Writing up the solution of a CTF mission is the best way to practise report writing. A good write-up explains not only the answer but the path to it:

• What did you have at the start, and what did you notice first?
• At each step, which finding led you to the next?
• How did you verify the answer?
• Which paths turned out to be dead ends?

On OSINT TR you can write a write-up for missions you have solved from the Community tab in the mission window. Only players who solved that mission can read it. For worked examples of the method see the write-ups page, and for how a report is built in company and candidate vetting see our due diligence guide.