A private acquirer was in advanced negotiations to purchase a profitable logistics software firm. The seller's data room was polished, the accounts audited, the story coherent. But the buyer's experience said that what a company knows about itself and what the open internet knows about it are different datasets — and standard legal and financial due diligence rarely touches the second one. Bureau Null was engaged to conduct OSINT due diligence: everything discoverable from open sources about the company, its infrastructure, and its key people.
The rules were strict: open sources only, no pretexting, no access attempts — everything in the final report had to be evidence a court or a counterparty could see reproduced. The investigation covered corporate registries and litigation across four jurisdictions, the company's full digital footprint including historical domains and code repositories, breach and credential-leak exposure, and background analysis of the three executives whose departure could take the company's value with them.
Corporate filings, court records and insolvency registers across four jurisdictions — surfacing an active supplier lawsuit and a settled wrongful-dismissal case absent from the data room.
Full enumeration of current and historical domains, subdomains, exposed services and public code repositories — including a staging server indexed by search engines with real customer data.
Cross-referencing company email domains against breach corpora and credential dumps: credentials for 14 staff accounts, including a sysadmin's, circulating since an undisclosed 2019 breach.
Open-source background analysis of the three critical executives — revealing that the CTO, presented as a long-term commitment, had incorporated a competing entity eight months earlier.
Renegotiated valuation after the report was presented — the undisclosed litigation and breach exposure moved directly onto the price.
Estimated exposure the buyer avoided: breach-notification liability under GDPR plus the cost of the inherited lawsuit.
Length of the final due-diligence report, every claim sourced to reproducible open-source evidence.
// results vary by project — ask us how we measured this one
“Everyone does financial and legal diligence. Almost nobody checks what the internet already knows about the target. This report paid for itself before the first page ended.”
Principal, acquiring firm · NDA engagement — reference call availableA fixed-scope security engagement ends with findings ranked by severity, reproduction steps and a remediation plan your team can execute. No theatre, no fear marketing.