Hello everyone. Today we’re going to discuss a term that has become increasingly popular in recent years: business intelligence.
To keep things simple and avoid getting too deep into theory, let’s define business intelligence as a branch of OSINT focused on collecting and analyzing information about commercial organizations and the individuals connected to them.
However, understanding the process is far more important than memorizing definitions, so that’s what we’ll focus on.
Business intelligence is a broad field. It can be used to assess potential partners, investigate competitors, identify hidden business relationships, uncover beneficial ownership, and evaluate risks before making important decisions.
Covering every aspect of the subject would be impossible in a single guide, so we’ll focus on the fundamentals. The goal is to provide a practical framework that you can start using immediately in your own investigations. Before we move on to the practical side, there are a few important principles worth understanding if you want to apply these methods effectively in practice.
Once we’ve covered them, we’ll move on to real-world scenarios and a structured approach to researching companies and the individuals associated with them.
Business Intelligence: Core Principles
First. Business intelligence is not a standalone discipline that exists in isolation. It goes far beyond simply searching Google or reviewing corporate registries and databases. In most cases, you’ll need to combine a wide range of OSINT techniques and skills.
This may include social media analysis, website research, collecting and analyzing personal data, locating and reviewing documents, and much more. The specific methods you use will always depend on your objective. And that leads us to the second important principle.
Second.The reason is simple. Even a relatively small or medium-sized company can generate an enormous amount of information. At a basic level, you may have registration records, real estate holdings, websites, social media accounts, employees, and sometimes even information about their relatives. If you expand the scope to include business partners and counterparties, each of them can lead to an entirely new set of data sources and investigative paths. And that’s still only a fraction of the information that may be available.
Now imagine how much irrelevant information you’ll have to process if you don’t know exactly what you’re looking for. Of course, you can work that way, but only if wasting time is part of your strategy. In practice, the first step should always be defining your objective and identifying the result you want to achieve.
That doesn’t mean you won’t come across other interesting topics during the investigation. Quite often, you will. If that happens, simply set them aside and return to them later if necessary.
Constantly jumping from one topic to another in the middle of an investigation is rarely a good idea. It significantly increases the chances of losing focus, getting overwhelmed by information, or overlooking something important.
Third. Data analysis. Even with a clearly defined objective, you’ll still end up collecting a considerable amount of information. That’s why gathering data is only half the job. The information you collect must be analyzed, organized, and presented in a way that makes sense.
This becomes especially important if your findings are intended for someone else. A report that is clear to you may not be clear to the person reading it. Good structure and logical organization make the difference between a useful report and a collection of disconnected facts.
The exact structure will always depend on the objective. If you’re simply gathering registration records or basic corporate information, the format may not matter much. But once you start drawing conclusions, proper analysis becomes critical.
Any conclusion should be supported by evidence. The reader should be able to see not only what you discovered, but also how you arrived at your conclusions. Your report should clearly demonstrate the connections between the facts you’ve uncovered, the events that occurred, and the assessments you’ve made. In other words, don’t just present conclusions. Show the reasoning behind them.
Четверте. While not strictly required, a basic understanding of business, taxation, and corporate law can be a significant advantage in business intelligence work.
The reality is that you’ll often encounter concepts, documents, and business structures that make little sense without some knowledge of how companies operate. The better you understand the business environment, the easier it becomes to interpret the information you uncover.
If you’re planning to work in business intelligence professionally, this knowledge is no longer optional. It’s difficult to analyze a company with confidence if you’re unfamiliar with fundamental concepts such as legal entities, ownership structures, corporate governance, or basic tax principles. You don’t need to become a lawyer, accountant, or tax specialist. However, understanding the fundamentals will help you ask the right questions, recognize important details, and avoid mistakes that could undermine your analysis.
The good news is that you don’t need to spend months studying economics textbooks or tax legislation before getting started. In most cases, you’ll learn what you need along the way. Whenever you encounter a term, concept, or process you don’t fully understand, take the time to research that specific topic and develop a basic understanding of how it works. More often than not, that’s enough.
As you continue working on investigations, you’ll repeatedly come across the same concepts and business processes. Over time, this knowledge accumulates naturally, and you’ll begin to navigate the key areas of business, taxation, and corporate structures with much greater confidence.
Fifth. Access to reliable data sources. This is less of a skill and more of a capability. However, having access to official and commercial databases will often give you a significant advantage over someone who relies solely on open sources. The reason is simple: specialized databases, commercial data providers, and official records can provide faster access to more complete and up-to-date information. Consider a simple example.
Suppose you’re trying to find out what real estate a company owns. Can this be done using open sources? In many cases, yes. We’ll look at those methods later. The real question is whether you can be sure you’ve identified all the properties associated with that company. In most cases, the answer is no.
Likewise, how can you be certain that a property you found through open sources wasn’t sold last week? Without access to up-to-date records, there is often no way to verify that. And then there’s the issue of time. Depending on the situation, collecting and cross-checking this information can take a significant amount of effort.
Someone with access to official and commercial databases, however, may be able to obtain the same information within minutes and with a much higher level of confidence. Such access often comes at a cost, but in professional investigations, the value of accurate and timely information usually outweighs the expense.
Now that we’ve covered the general principles, it’s time to move on to the practical section.
To keep things clear and structured, we’ll approach different areas of work separately. Since this is a broad topic, we’ll first outline what types of information may be relevant, and then look at the methods used to collect it in practice.
Registration Data
The analysis of any organization begins with the collection of registration data. This is necessary for accurate identification of the target entity. The exact set of available information may vary depending on the jurisdiction, but the core data points are generally the same. In most cases, this information can be obtained from public company registries, which are available in virtually every country. In addition to registry data, all information should also be independently verified using search engines. This often provides additional context and reveals details that may not be visible in official sources.
Company Name. A company name alone is often not sufficient for reliable identification, as multiple unrelated entities can share the same name. At the same time, the opposite is also true: many organizations do not put much effort into creating unique names and instead reuse existing ones with only minor changes, such as adding a word or a number.
Because of this, the company name should always be searched in multiple ways. Use quotation marks to find exact matches, and also perform searches without them to allow search engines to return variations, partial matches, and related results that may help identify additional relevant information.
Numeric Identifiers. Every organization has one or more numeric identifiers. For individual entrepreneurs, this is typically a tax identification number. For legal entities, this may include a company registration number and, in many cases, a tax identification number as well.
In all cases, these are unique identifiers that cannot be duplicated, making them a reliable way to precisely identify a specific entity. These numbers should always be searched as exact matches. First, this allows you to quickly locate official registry entries, which may vary in the level of detail depending on the jurisdiction. Second, different registries may contain different amounts of information about the same entity, so cross-checking can provide additional useful data.
Finally, numeric identifiers are significantly more reliable than company names when it comes to search accuracy. Even if a company name is misspelled or varies across sources, a registration number is far less likely to be misrepresented, which makes it one of the most effective search parameters.
Founders. Founders are, in simple terms, the individuals or legal entities that establish a company. These can be either individuals or legal entities. This information is usually available through public registries. However, it is important to remember that founders can change over time, so historical data should always be taken into account.
It is also important to understand that a founder is not necessarily the same as an owner or ultimate beneficial owner. In some cases, founders may act as nominal figures representing the interests of others, or may have no real involvement in the actual control of the company.
Nevertheless, founders should always be considered and at least briefly analyzed. Even indirect participants can be linked to other organizations that are not immediately visible at first glance, or may help identify the real controlling parties behind the business.
Company Officers. Officers are individuals who are responsible for the day-to-day management and overall direction of an organization. In most cases, this refers to the director, possibly deputy directors, and the chief accountant. In some types of organizations, more specific roles may also exist, such as a chief engineer.
In public registries, you may also come across the term “authorized representative.” In most cases, this refers to the director or chief accountant. However, it is important to remember that an authorized representative can also be someone who holds a power of attorney to represent the organization, for example for tax reporting or other official procedures.
Registered Address. A registered address is the official address under which a company is legally registered. This does not necessarily mean that the company actually operates from that location. In some cases it does, but very often it does not, so this information should always be verified where possible.
It is also common for service providers to offer registered address services to multiple companies. Because of this, visiting such an address may lead you to a small office that provides basic administrative services rather than any real business operations.
As a result, if you find that dozens or even hundreds of companies are registered at the same address, this usually does not indicate any meaningful connection between them. In most cases, it simply reflects the use of a shared registration service. However, it can still be treated as a potential risk indicator, as it may suggest limited transparency or a more complex corporate structure.
In some jurisdictions, operating from a different location than the registered address may be a legal issue. In others, such as offshore jurisdictions, this is standard practice and does not necessarily indicate any irregularity.
Business Intelligence: Analyzing Corporate Relationships
Now that we’ve collected the basic registration data, we’re one step closer to the objective, but still far from a complete picture. The next step is to identify relevant connected parties and filter out unrelated entities. In other words, we need to conduct a link analysis of the organization.
This is not necessarily a complex task, but it is almost always time-consuming and data-intensive.
We always start link analysis from the registration data already available to us. The exact order is not critical, but it is usually most practical to begin with the founders and the company director. At this stage, we stay within public registries and do not move beyond them. In most cases, this data is sufficient for the initial phase of analysis (for example: https://www.list-org.com/company/11581022)
We then go through each founder individually, including historical records where available, and note any other organizations they are associated with. After that, we apply the same approach to those organizations, looking for overlaps, shared connections, or any additional relevant links. This process is repeated iteratively until further expansion no longer provides meaningful results or the network has been sufficiently mapped.
It is important to remember that the same individual may appear in different roles across different entities — for example, as a director in one company, a founder in another, and in an entirely unrelated position elsewhere. Because of this, registries often support searches by full name, but whenever possible it is better to rely on personal or tax identification numbers to avoid confusion caused by identical or similar names.
Many registry platforms also provide a visual representation of corporate relationships in the form of a connection tree. This brings us to an important point: alongside collecting and documenting information, you should already begin building your own relationship map at this stage. This helps you visualize connections, remove irrelevant branches, and focus on meaningful links. The format you use does not matter — it can be a notebook, a whiteboard, or an online tool.
Personally, I prefer tools like https://app.diagrams.net or XMind, especially when the results need to be presented to someone else. If not, a simple hand-drawn sketch is often enough and can even be more effective for thinking through the structure.
It is also worth noting that built-in registry relationship trees are limited. They only reflect data available within a specific registry, which means they can include noise while missing important external connections. For this reason, they should be treated as a reference point rather than a complete representation of the network.
Finally, building your own relationship map is not just a visualization exercise — it actively improves your understanding of the structure you are analyzing and helps reveal connections that might otherwise remain unnoticed.
Beneficial Owner
The next type of relationships is based on the beneficial owner. A beneficial owner is not necessarily the person listed in official documents, but rather the individual who ultimately owns or controls the company in practice.
The main challenge is that this person is not always publicly known. In large, well-established businesses, the beneficial owner is usually disclosed and relatively easy to identify. However, with smaller, less transparent, or regional companies, determining the real controlling party can be significantly more difficult.
Because of this, identifying the beneficial owner can itself become part of the investigation. In some cases, uncovering who actually owns and controls the company — rather than who appears on paper — may be the final goal of the analysis.
Since the beneficial owner is often the central figure in the entire structure, all relationships connected to them are especially important and should be examined carefully. At the same time, it is important to keep in mind that a single individual may be involved in multiple businesses that are either unrelated or only loosely connected. These links should always be interpreted in the context of the specific investigative objective.
In addition to corporate connections, it is essential to look at personal networks as well. This includes individuals within the beneficial owner’s close circle. In many cases, analyzing relatives and close associates can provide valuable leads and reveal connections that would otherwise remain hidden.
Business Intelligence: Methods of Collecting Information
So, we’ve collected the registration data, analyzed the relationships, and identified the beneficial owner. This is usually enough to understand the general structure of the target.
However, there are situations where a deeper level of analysis is required, and more detailed information from a specific area needs to be gathered. Let’s look at how this can be done.
Document Search
Company documentation is an important and, most importantly, highly reliable source of information. Bureaucracy within state regulatory systems still exists, and it generates records for almost everything. As a result, any relevant information about a legal entity is usually documented somewhere.
This is also where access to data sources can be particularly effective, although it is not a universal solution. A lot of useful information can still be found manually through open sources.
There is a separate article on document OSINT on document search, so here we will only focus on a few key points.
The main method for finding documents is Google, its dorks, and its tendency to index almost everything available online. In practice, we will use the filetype: operator, combining it with the information we already have about the target.
First of all, we look for documents that mention the name of the target organization. At the same time, it is important not to limit the search to a single file type. In most cases, PDFs, text files, spreadsheets, and occasionally presentations will cover most of the relevant material.
We also should not rely solely on the company name. It is important to check the company’s own website for any publicly available documents as well. This can be done manually:
site:domain filetype:pdf
Another useful tool is Metagoofil. In practice, I usually start by checking whether any documents are available directly through a search engine. If there are only a few files (for example, two or fewer), it is usually easier to download them manually. However, if there are more, it becomes more efficient to use Metagoofil. It saves time and also extracts metadata from the documents, which can sometimes provide additional useful insights.
This is the basic level of document discovery. Beyond that, it is often useful to search for documents containing company identifiers, as well as names of founders and directors. The approach remains the same — using Google dorks with the filetype: operator combined with relevant keywords. Quotation marks should also be used whenever exact matches are required.
In general, since it is difficult to predict what kind of documents may be publicly available, it makes sense to experiment with any reasonably unique identifiers. In some cases, highly useful documents have been discovered using queries such as:
“product name” filetype:docx
Finally, it is important to emphasize that finding documents is only the first step — they must also be carefully analyzed. Pay attention to any relevant details such as names, addresses, phone numbers, vehicles, counterparties, and similar data points. It is often useful to extract and structure all available facts, as in this context volume can eventually lead to meaningful insights.
Real Estate Search
Another common task when investigating a company is identifying real estate assets it owns or operates from.
At this stage, we usually already have the registered address. However, as mentioned earlier, there is no guarantee that the company actually operates from that location. In addition, the organization may have other offices, warehouses, or production facilities, which are exactly what we are trying to identify.
A good starting point is always the company’s official website. In most cases, the listed address will match the registered one, but it may also include additional locations such as branch offices, service points, or production sites.
Whenever we identify an address, it is worth checking it on a map using street view. This can often provide additional context such as signage, nearby infrastructure, or other visual cues. In some cases, vehicles in the area may also provide useful leads. Although mapping services often blur license plates, this is not always consistent.
Another valuable source is social media, both official company pages and employee profiles. Addresses may be explicitly mentioned, or locations may be embedded in photos via geotags. In some cases, it may even be necessary to perform geolocation based on visual clues in images. There are no special techniques here — it is mostly a systematic review of available information and careful documentation of everything that may be relevant, not just locations.
Another useful resource is https://2gis.ru. Searching by company name can help identify office locations, warehouses, production facilities, and similar sites. It is also worth reviewing associated photos, as they can sometimes contain additional useful details.
Now let’s move on to less obvious methods of locating real estate. One effective approach is using job posting websites. Job listings often include workplace addresses or map links to the actual location. By using the site: operator to restrict the search to specific job platforms and combining it with the company name, it is often possible to discover additional locations associated with the organization.
After that, we go through the list of job postings and extract any relevant information. It is also worth paying attention to employee reviews, if they are available, as they can sometimes contain useful insights.
The same approach can also be applied to court records and legal case databases.
By the way, court records should always be included in the research process. In addition to possible references to real estate, they often contain valuable details about the company and its operations. This may include contract numbers, agreement dates, and other related documentation, as well as summaries of their content. In many cases, this information can be highly useful.
In addition, a careful review of court decisions involving the company can help identify problematic areas and provide a better understanding of the risks associated with its activities.
Employee Search
The next task you are likely to encounter is identifying employees working within a company. We have already mentioned some of the methods that can be used in this context, including document analysis, metadata from files on the company’s website, and social media research. In the case of social networks, it is also important to review the company’s own pages, as employees are often subscribed to them and may leave comments on posts that help confirm their affiliation.
This approach is particularly effective in Western contexts, where users are more likely to openly list their workplace on platforms such as Facebook. LinkedIn is especially valuable here, as it allows direct identification of employees and provides a significant amount of professional background information. On other social networks, however, gathering such data usually requires more manual and time-consuming work.
Another method of identifying employees is through corporate email addresses. This is especially useful in larger organizations, although it should always be verified.
The key point is that companies rarely use arbitrary usernames in corporate emails. Instead, email formats often include the employee’s surname and sometimes initials. In addition, many people reuse their corporate email addresses when registering on various services, which can create additional traces. These two factors can be useful for analysis.
By this stage, the company’s domain should already be known. If there are multiple possible domains or uncertainty remains, it is useful to check email addresses from publicly visible departments such as the press service to confirm the correct corporate domain. It is also advisable to verify all related domains, as this may reveal additional useful information.
Once the correct domain is identified, searches can be performed using email patterns combined with quotation marks for exact matches, for example: @“domain.com”.
At this stage, we simply collect all email addresses that can be found in open sources, along with any related contextual information. This approach often makes it possible to identify, if not all, then at least a significant number of employees within the organization.
Instead of a Conclusion
This is where we can wrap up our introduction to business intelligence. Of course, we have not covered all possible methods and techniques for collecting information about legal entities. However, the material presented here should be enough to help you start working at a solid practical level, with a clear understanding of what you are doing.
With practice, you will naturally develop a better understanding of the nuances and edge cases. Like any other OSINT discipline, business intelligence requires a lot of hands-on experience.
Stay with the OsintFlow team!