Certification Courses
Hands-On Labs
Threat Intelligence
Latest Cyber News
MITRE ATT&CK Breakdown
All Cyber Keywords
Latest News
Reconnaissance – Enterprise
T1591 – Gather Victim Org Information
The foundational reconnaissance technique where adversaries build comprehensive organizational profiles , mapping locations, relationships, tempo, and roles to craft devastatingly targeted attacks.
Physical Locations
23 global offices identified. Headquarters: San Francisco, CA. Regional hubs: London, Tokyo, Singapore. Satellite offices mapped with satellite imagery and public permits.
Business Partners
47 third-party vendors cataloged. Key relationships: AWS, Salesforce, Deloitte. Supply chain dependencies mapped across 12 critical service providers.
Operating Hours
Standard business hours: 08:00–18:00 local time. Quarterly closes: last Friday. Reduced staffing on holidays and weekends , peak vulnerability windows identified.
Key Personnel
C-suite executives, VP-level directors, and their executive assistants profiled. Travel patterns analyzed via social media and conference attendance records.
▲ Organizational Hierarchy Map
CEO – James Chen
VP Engineering
VP Finance
VP Operations
Dir. Infrastructure
Dir. Treasury
Dir. Logistics
Dir. DevOps
Cloud Ops Mgr
Sr. Accountant
Fleet Coordinator
★ Threat Profile Score
Location Exposure92/100
Relationship Mapping85/100
Tempo Analysis78/100
Role Identification95/100
Composite Org Exposure Index
87.5
Context & Impact
Why T1591 Matters
The gateway technique that transforms generic attacks into surgical strikes
T1591 is the overarching organizational reconnaissance technique , it represents the adversary's systematic effort to understand WHO the target organization is, WHERE they operate geographically and digitally, WHEN their teams work and when defenses are weakest, and WHO holds the keys to kingdom within the corporate hierarchy. This is not passive intelligence collection; it is the deliberate assembly of a strategic attack profile. Every piece of organizational data harvested through T1591's four sub-techniques feeds directly into more sophisticated attack chains , from whaling emails impersonating the CFO, to supply chain compromises through trusted vendors, to physical social engineering timed to office moves. Organizations that treat this data as public and harmless are handing adversaries the blueprint they need to bypass nearly every technical control in their security stack. The statistics below illustrate the devastating real-world impact of organizational intelligence gathering when combined with social engineering and targeted intrusion campaigns.
72%
of respondents say cyber risks have risen in the past year, driven by increasingly sophisticated reconnaissance-enabled attacks
Source: WEF Global Cybersecurity Outlook 2025
80%
of companies reported a significant increase in security incidents, many originating from organization-targeted reconnaissance
Source: AppSecurity Report
70%+
of global data breaches involve social engineering tactics fueled by organizational intelligence gathered via techniques like T1591
Source: Verizon DBIR via miniOrange
$4.88M
average cost of a data breach in 2024, with org-targeted attacks commanding significantly higher remediation expenses
Source: IBM / Fortinet Report
#1
social engineering remains the top cyber threat in 2025, with organizational reconnaissance as its primary enabler
Source: miniOrange Cyber Threat Report
Definitions
Key Terms & Concepts
Understanding the language of organizational reconnaissance
Formal Definition
Gather Victim Org Information (T1591) is a MITRE ATT&CK reconnaissance technique where adversaries collect comprehensive intelligence about a target organization , including physical locations, business relationships, operating tempo, and organizational roles. This intelligence enables attackers to craft highly targeted social engineering campaigns, time attacks for maximum impact during periods of reduced staffing or heightened stress, select the most valuable individuals for impersonation or coercion, and exploit business partnerships for supply chain compromise. T1591 encompasses four distinct sub-techniques , T1591.001 (Determine Physical Locations), T1591.002 (Business Relationships), T1591.003 (Identify Business Tempo), and T1591.004 (Identify Roles) , each addressing a specific dimension of organizational exposure that adversaries methodically exploit.
Core Components
T1591 feeds directly into the Pre-ATT&CK and later stages of the kill chain. The intelligence gathered here informs Target Selection (which individuals or systems to pursue), Spear-phishing Preparation (crafting believable lure content), Supply Chain Targeting (identifying vulnerable third-party partners), and Physical Access Planning (understanding building layouts and security schedules). Adversaries typically combine OSINT from public sources (LinkedIn, SEC filings, job postings, press releases, Google Maps) with passive reconnaissance (DNS records, WHOIS, certificate transparency logs) to build a multi-layered organizational profile without triggering any defensive alerts.
💡 Everyday Analogy
Think of T1591 like a corporate spy preparing to infiltrate a company. Before stepping foot inside, they learn which buildings the company occupies (locations), who their suppliers and clients are (relationships), when the office is busiest and when security is thinnest (tempo), and who the decision-makers are (roles). They build a complete organizational profile that reveals every vulnerability, every weak point, and every opportunity for exploitation. Just as a master chess player studies their opponent's patterns before making the first move, an adversary using T1591 patiently assembles every fragment of publicly available organizational data into a strategic intelligence dossier , one that transforms a random, noisy phishing attempt into a devastatingly precise social engineering operation capable of compromising an entire enterprise through a single well-crafted email to the right person at the right time.
Case Study
Real-World Scenario
How T1591 enabled a $12.5 million whaling attack
SM
Sarah Mitchell
VP of Corporate Security, Axiom Dynamics
⚠ Before Mitigation
Axiom Dynamics' corporate website, LinkedIn, press releases, and SEC filings freely disclosed office locations, executive biographies, partnership announcements, and quarterly earnings schedules. A nation-state APT group spent 4 months building a comprehensive organizational profile. They identified that the CFO traveled to the London office monthly (physical locations), used a specific cloud accounting platform (business relationships), conducted quarterly closings on the last Friday of each month (tempo), and that the CFO's executive assistant had recently been hired (roles). They crafted a whaling attack impersonating the CFO to the assistant, requesting an urgent wire transfer timed to coincide with the quarterly close when the finance team was overwhelmed.
$12,500,000 transferred before fraud detection
✅ After Mitigation
Sarah implemented a comprehensive organizational exposure reduction program that fundamentally changed Axiom Dynamics' public footprint. She removed detailed office addresses from all public-facing websites and replaced them with generic regional contact forms. She established strict non-disclosure protocols for partnership announcements, ensuring vendor relationships were never publicly enumerated. Executive travel schedules were randomized and communicated only through encrypted channels. All executive assistants underwent mandatory verification procedure training with simulated whaling exercises conducted quarterly. AI-powered email authentication was deployed across the organization, detecting impersonation attempts with 99.7% accuracy. The result: zero successful social engineering incidents in the following 18 months and a 94% reduction in targeted phishing emails reaching employee inboxes.
Actionable Guide
7-Step Defense Framework
Systematically reducing your organizational exposure to T1591 reconnaissance
Conduct a Comprehensive Organizational Exposure Audit
Begin by cataloging every piece of organizational information publicly available about your company. Search SEC filings, press releases, LinkedIn company pages, job postings, Google Maps listings, domain WHOIS records, certificate transparency logs, and social media profiles. Document what each data point reveals and assess which combinations create exploitable intelligence patterns. Assign risk ratings to each exposure category.
DETECT EXPOSUREMinimize Public Disclosure of Physical Locations
Remove specific street addresses from public-facing websites. Replace with regional contact forms or PO boxes for general correspondence. Audit Google Maps and Bing Maps business listings to ensure satellite imagery doesn't reveal sensitive infrastructure. Implement visitor management policies that prevent external mapping of office layouts. Consider removing floor plans and building photos from marketing materials and real estate listings.
PREVENT LEAKAGEEstablish Partnership Disclosure Policies
Create clear guidelines governing what partnership information can be publicly shared. Avoid announcing specific technology vendors, service providers, or supply chain relationships unless operationally necessary. Require legal and security review of all press releases, case studies, and marketing materials that reference third-party relationships. Implement NDA frameworks that address public disclosure of business partnerships.
PREVENT LEAKAGEMask Operational Patterns and Business Tempo
Randomize predictable patterns such as maintenance windows, financial closing schedules, and executive travel routines. Avoid publishing earnings call schedules, product launch dates, or quarterly planning timelines in advance. Vary meeting schedules and communication patterns so that adversaries cannot establish reliable behavioral baselines. Use out-of-office responses sparingly and without revealing specific future availability patterns.
PREVENT PREDICTIONProtect Executive and Role Information
Implement least-privilege publishing policies for organizational charts and reporting structures. Remove detailed executive biographies from public websites, replacing them with minimal role descriptions. Train executives on social media OPSEC , limiting public posts about work activities, travel, and professional relationships. Establish executive communication channels that are separate from publicly discoverable email addresses and phone numbers.
REDUCE TARGETSImplement Social Engineering Defenses
Deploy multi-layered email authentication (SPF, DKIM, DMARC) configured to reject rather than quarantine fraudulent messages. Implement AI-powered email analysis that detects whaling attempts by analyzing communication pattern deviations. Conduct regular social engineering simulations targeting executive assistants, finance teams, and HR personnel. Establish secondary verification channels for high-value transactions and sensitive requests.
ACTIVE DEFENSEEstablish Continuous OSINT Monitoring
Deploy automated OSINT monitoring tools that continuously scan for new organizational information appearing across public sources. Monitor paste sites, dark web forums, data broker aggregators, and social media for mentions of your organization's employees, locations, and relationships. Establish alert thresholds that trigger security reviews when new organizational data appears. Conduct quarterly red team OSINT exercises to measure your external exposure footprint over time.
CONTINUOUS MONITORINGLessons Learned
Common Mistakes & Best Practices
Avoid these pitfalls and adopt proven defensive strategies
5 Common Mistakes
Publishing full office addresses , Detailed building addresses on contact pages and Google Maps listings provide adversaries with exact physical targeting data for social engineering, tailgating, and even physical penetration testing of your facilities.
Announcing vendor partnerships publicly , Press releases, case studies, and job postings that name specific technology vendors create a supply chain attack map. Adversaries will target your weakest vendor link rather than your hardened perimeter.
Maintaining predictable operational schedules , Publishing quarterly closing dates, maintenance windows, or product launch timelines allows adversaries to time attacks during periods of maximum distraction and minimum security staffing.
Detailed executive bios on public websites , Comprehensive biographies that list reporting structures, previous employers, board memberships, and professional associations give adversaries everything needed for convincing social engineering impersonation.
Assuming org data is harmless because it's public , The most dangerous mistake is believing that publicly available information cannot be weaponized. Intelligence aggregation transforms innocuous individual data points into devastating organizational attack profiles.
5 Best Practices
Conduct quarterly OSINT exposure audits , Systematically catalog every piece of organizational data available from public sources and document the intelligence value each data point provides. Track changes over time to identify new exposure vectors as they emerge.
Implement a data minimization policy , Apply a "need-to-publish" framework where every piece of organizational information publicly disclosed must pass a risk-benefit analysis. Default to minimal disclosure; require justification for detailed publication.
Train executives on OPSEC fundamentals , Provide role-specific operational security training for C-suite executives and their support staff. Cover social media posting guidelines, travel schedule protection, and recognition of pretexting attempts.
Deploy technical countermeasures proactively , Implement DMARC at enforcement policy level, deploy AI-powered email authentication, and use multi-factor verification for high-risk transactions. Technical controls must complement human awareness training.
Build a threat-informed disclosure culture , Foster cross-functional collaboration between marketing, HR, legal, and security teams so that every public disclosure , from job postings to earnings announcements , is reviewed through an adversarial intelligence perspective.
Dual Perspective
Red Team vs Blue Team View
Understanding T1591 from both sides of the cybersecurity battlefield
Red Team (Attacker) Perspective
T1591 is the intelligence foundation of every targeted campaign , without understanding the target organization, we cannot craft convincing lures or identify high-value access paths.
We begin with passive OSINT: LinkedIn scraping for org charts, SEC Edgar filings for financial data, Google Maps for facility locations, and job postings for technology stack enumeration.
Business relationships are the highest-value intelligence , a trusted vendor's compromised account provides authenticated access that bypasses nearly all perimeter security controls.
Operational tempo data enables temporal targeting: we launch phishing campaigns during quarterly closes, office moves, or leadership transitions when attention is divided and verification procedures are relaxed.
Role identification allows precision targeting: we don't mass-phish , we impersonate the CFO to their assistant, the CTO to their direct reports, or the facilities manager to building security. One well-crafted message to the right person yields domain admin credentials.
ATK ↔ DEF
Blue Team (Defender) Perspective
We cannot prevent adversaries from conducting OSINT, but we can dramatically reduce the intelligence yield by minimizing what organizational data we publish externally.
Data minimization is our primary defense: remove office addresses, limit executive biographies, anonymize job postings where possible, and review all public communications through an adversarial lens.
Even when organizational data is public, technical controls like DMARC enforcement, AI email authentication, and multi-factor transaction verification ensure that intelligence-gathering cannot be translated into successful access.
Continuous monitoring of our own OSINT footprint allows us to detect and remediate new organizational exposures before adversaries can aggregate them into actionable intelligence packages.
Human defense layers , trained executive assistants who verify unusual requests through secondary channels, security-aware executives who limit social media exposure , provide the last line of defense when technical controls are circumvented.
Detection & Hunting
Threat Hunter's Eye
Hunting for indicators of T1591 reconnaissance activity targeting your organization
LinkedIn Profile Scraping Indicators
Monitor for anomalous LinkedIn profile view patterns targeting your organization's employees. Multiple profile views from accounts with no mutual connections, newly created profiles, or accounts listing competitor companies may indicate adversarial reconnaissance. Track referral sources in your website analytics for suspicious LinkedIn-originating traffic spikes.
WHOIS & DNS Reconnaissance
Monitor WHOIS query logs for bulk lookups of your organizational domains. Track DNS enumeration patterns in authoritative name server logs. Unusual TXT record queries, SPF/DKIM record lookups, and subdomain brute-force attempts indicate an adversary is mapping your digital infrastructure alongside your organizational structure.
Job Posting Intelligence Mining
Monitor which external IPs and user agents are scraping your careers page. Adversaries analyze job postings to determine technology stacks (from required skills), organizational structure (from reporting relationships), and security tools deployed (from security-specific role requirements). Unusual download patterns of job descriptions warrant investigation.
Document Metadata Analysis
Monitor for bulk downloads of publicly hosted PDFs, presentations, and documents from your website. Adversaries extract metadata including author names, organizational unit structures, software versions, and internal paths. A spike in document downloads from a single IP range often precedes a targeted campaign.
▸ Sample Detection Queries
index=web_logs uri="/careers*" status=200 | stats count by src_ip, user_agent | where count > 50 | sort -count
index=dns (query_type="TXT" OR query_type="SPF" OR query_type="MX") domain="*target-org.com" | stats count by src_ip | sort -count
index=proxy uri="*/about*" OR uri="*/team*" OR uri="*/leadership*" | stats count dc(uri) as pages_viewed by src_ip | where pages_viewed > 10
index=web_logs user_agent="*scrapy*" OR user_agent="*python-requests*" OR user_agent="*httpclient*" domain="*target-org.com" | stats count by src_ip
index=email dmarc_policy="reject" from_domain!=target-org.com AND (subject="*urgent*" OR subject="*wire*" OR subject="*transfer*") | stats count by from_domain
Explore Sub-techniques
Deep Dive into T1591 Sub-techniques
T1591 encompasses four specialized sub-techniques, each addressing a critical dimension of organizational reconnaissance. Explore each one to understand specific attack vectors, detection strategies, and defensive countermeasures.
Gather Victim Org Information
SUB-TECHNIQUES
MITIGATIONS
DETECTION STRATEGY
DONATE · SUPPORT
ROOT::DONATE
- April 2, 2026
- No Comments