Programme Overview
Day 1 – Research Environment, Tooling, Personas & Legal Framework
- Building professional research environments
- Commercial and open-source OSINT tooling
- Hardware hygiene and dedicated investigation environments
- eSIMs, burner devices and operational anonymity
- Persona and sock-puppet management
- VPNs, Tor and browser fingerprint management
- GDPR, ECHR and legal considerations for investigations
- Research Environment Standard development
Outcome: Participants learn how to establish a defensible operational environment that balances investigative effectiveness, security and legal compliance.
Day 2 – Adversarial OSINT & AI in Intelligence Operations
- Understanding adversarial OSINT
- Reconnaissance against individuals and organisations
- Counter-OSINT methodologies
- Organisational attack surface analysis
- AI-assisted intelligence collection and analysis
- Prompt engineering for OSINT
- Deepfakes and synthetic content detection
- Hallucination risks and verification discipline
- Threat-aware investigation planning
Outcome: Participants learn how attackers leverage OSINT and how AI can be used effectively without compromising analytical quality and reliability.
Day 3 – Capstone Exercise: Briefing & Collection Planning
- Operational case briefing
- Intelligence requirements definition
- CCIRM application under operational constraints
- Collection planning
- Resource allocation and prioritisation
- Investigation strategy development
Outcome: Participants transform a complex intelligence requirement into a structured and executable investigation plan.
Day 4 – Capstone Exercise: Collection & Evidence Management
- Intelligence collection under time pressure
- Multi-source validation
- Evidence preservation
- Berkeley Protocol application
- Scope management and decision logging
- Real-time investigative adjustments
Outcome: Participants conduct a live investigation while maintaining operational discipline, documentation standards and evidential integrity.
Day 5 – Capstone Exercise: Analysis, Reporting & Defence
- Intelligence analysis and synthesis
- Confidence assessment
- Professional intelligence report production
- Executive briefing preparation
- Presentation to an expert review panel
- Defence of methodology, findings and conclusions
Outcome: Participants demonstrate their ability to deliver operationally relevant intelligence products that can withstand executive, legal and professional scrutiny.
Prerequisites
Participation in the OSINT Advanced Masterclass requires successful completion of both the OSINT Foundation Masterclass and the OSINT Practitioner Masterclass.
Participants are expected to have demonstrated proficiency in:
- Operational Security (OPSEC) and investigation hygiene
- Intelligence Cycle methodology and intelligence requirements management
- Advanced search and validation techniques
- Multi-source verification and evidence preservation
- CCIRM (Collection Coordination & Intelligence Requirements Management)
- Multi-INT investigations
- Intelligence reporting and executive briefings
- Audit-proof documentation and traceability practices
The Advanced programme does not revisit these concepts. Instead, participants are expected to apply them independently in increasingly complex and realistic operational scenarios.