OSINT Predictions for 2026: Threats, Tradecraft, and What’s Next
Each year, Fivecast CEO and Co-Founder Dr. Brenton Cooper shares predictions on the evolving OSINT landscape. Explore this year’s insights to see what’s changed – and what’s next.
Why 2026 will be pivotal for OSINT
Open-source intelligence (OSINT) continues to move from the margins to the mainstream across government and commercial sectors, driven by escalating online threats, the explosion of public and commercial data, and the need to fuse multiple sources for faster, confident decisions.
1. Foreign threats grown at home will demand new vigilance
In December 2025, Australia experienced its deadliest domestic terrorist attack, when a father-and-son duo targeted a Hanukkah celebration at Bondi Beach in Sydney, killing 15 people and injuring dozens more. While authorities found no wider terrorist network, authorities confirmed the attack was ideologically motivated and inspired by foreign extremist narratives, prompting a national Royal Commission into antisemitism and urgent reviews of intelligence and law enforcement responses. The incident highlights the need for proactive online monitoring and rapid detection of hate-driven mobilization, reinforcing ASIO’s warnings about the increasing risk of homegrown extremism.
Read our OSINT to Counter Antisemitism Blog
This event is part of a broader pattern: geopolitical tensions in Eastern Europe, the Middle East and the Indo-Pacific are increasingly spilling over onto home turf across AUKUS and European nations. Hostile states are recruiting proxies and exploiting social platforms to cultivate insiders and sow division. In November 2025, the UK’s Security Minister Dan Jarvis highlighted MI5’s espionage alert about Chinese operatives posing as headhunters and conducting outreach at scale on professional networking sites.
Australia’s ASIO chief, Mike Burgess, likewise warned that foreign services, sometimes even from countries considered friendly, are relentlessly targeting defense personnel and critical infrastructure, leveraging deeper online pools of personal data, AI, and social engineering.
What to do now: Monitor mainstream and niche platforms, apply network‑aware analytics, and fuse OSINT with other data to detect early risks – including ideological and hate‑motivated narratives. Fivecast ONYX quickly identifies emerging narratives, mobilization signals, and identity links across text, images, and video, enabling teams to track online mobilization and violent extremist activity.
Read our Case Study: Protecting Communities from Extremist Threats
2. Businesses will proactively protect themselves with advanced intelligence
Commercial espionage and direct-action sabotage increasingly target companies – stealing IP, exfiltrating negotiation data, and catalyzing physical disruption. In 2025, UK Counter Terrorism Policing detailed convictions and later sentencing in a Russian ordered arson attack against Ukrainian owned businesses in London, illustrating hostile state use of local proxies.
ASIO has similarly cautioned that state-backed actors are escalating high impact sabotage and targeting private sector data to gain advantage in contract negotiations.
Fivecast customers are already leveraging AI- enabled OSINT to gain early warning of scams and digital threats targeting executives, detect threat actors mobilizing across social media and niche platforms, and translate online signals into protective action at sites and events.
What to do now: Integrate OSINT into corporate security workflows – screen vendors, monitor activist mobilization, and trace insider risk indicators such as sudden lifestyle changes across the web. Fivecast ONYX and Fivecast LUNEX enable curated foundational networks plus ongoing monitoring tuned to your thresholds, so teams can escalate only the signals that matter.
3. Online foresight will sharpen defense readiness
In NATO aligned communities, OSINT is now part of the standard all source toolkit, augmenting situational awareness before and during conflicts. Research and commentary from RUSI (Royal United Services Institute) and other analysts show how social media and open imagery have informed targeting and movement verification in Ukraine, while poor social media discipline has exposed sensitive locations and contributed to lethal targeting.
Open‑source datasets and investigative projects have documented troop movements, equipment losses, and potential war crimes by pinpointing locations and timing of events, demonstrating OSINT’s value for both operational and accountability missions.
What to do now: Standardize opensource collection plans, automate trend detection, and fuse OSINT with classified feeds for rapid triage. Fivecast ONYX accelerates discovery and AI-enabled analysis; Fivecast LUNEX adds curated foundational networks to jumpstart investigations; and Fivecast MATRIX automates high throughput screening for vetting and continuous evaluation.
4. Ethical AI will be essential to bringing online crime into the open
Generative AI is amplifying phishing accuracy and enabling deepfake voice/video fraud – eroding trust in content and communications. National threat assessments warn that foreign intelligence services will exploit AI and vast online data to drive disinformation and degrade institutions.
The way forward is ethically guided, explainable AI inside OSINT workflows, flagging machine generated content, mapping information flows, and providing contextual signals about potential attribution. Fivecast’s platform emphasizes responsible AI, configurable risk frameworks, and analyst in the loop review – augmenting, not replacing, human judgment.
What to do now: Adopt transparent models and auditable workflows; use multi‑modal detection (text, images, video) to identify synthetic narratives and unusual patterns; and capture a clear record of source information. Fivecast ONYX’s configurable detectors and auditability support these requirements.
5. OSINT gets a permanent seat at the intelligence table
Across allied communities, OSINT is being professionalized with strategies, standards, and budgeting focus. In the US, OSINT leaders are building off the Intelligence Community’s OSINT strategy with pillars spanning innovation, workforce, data sharing, and collection management – signaling mainstream adoption and data fusion expectations.
Operationally, this means correlating opensource with high side intelligence at speed and scale requiring platforms that can ingest, normalize, and enrich diverse sources via secure integrations. Fivecast’s product architecture provides OSINT data fusion and API integrations to streamline delivery into existing workflows.
What to do now: Formalize OSINT tradecraft, codify governance and oversight, and build bridges to classified environments through standards aligned integrations and audit trails.
6. Vetting at scale: Police, borders, and agencies will spot risks earlier
Security vetting, border screening, and law enforcement applicant checks need speed, scale, and consistency without sacrificing oversight. Fivecast MATRIX is proven to be over 20× faster than manual account resolution and has saved a Five Eyes vetting agency ~35,000 hours in the first four months of operation, enabling continuous evaluation and repeatable risk assessment across multimedia data.
One national vetting agency processes 6,000–7,000 candidates per month with this approach, cutting noise and surfacing actionable online risks for trained officers to review and action.
What to do now: Automate digital footprint collection across open, deep, and dark web sources, apply configurable rule sets for consistent detection, and deliver auditable reports to downstream systems. Fivecast MATRIX’s workflow, reporting, and continuous evaluation capabilities are designed for exactly this.
Bringing it together: Embedding OSINT across daily intelligence workflows
From police services to multinational corporations, OSINT will continue to embed across daily operations from insurance fraud detection to tender/licensing checks and insider risk programs, replacing manual processes with scalable, configurable automation integrated into existing systems.
Fivecast delivers purpose-built intelligence across the entire lifecycle – automated discovery, deep investigations, and scalable vetting and screening, all underpinned by responsible, explainable AI. Our Fivecast ONYX, Fivecast LUNEX, and Fivecast MATRIX solutions combine to help teams rapidly map digital footprints, resolve identities, enrich investigations with curated networks, and perform large-scale risk analytics. With Fivecast, you cover more, miss less, and act with confidence in an increasingly complex digital world.
