OSINT Training
Learn tradecraft from investigators who use it every day.
Our courses are taught by the analysts who run Aldervane's live cases. Every exercise is built from a real investigation with identifying details removed, and every student leaves with a repeatable method rather than a list of tools that will change next year.
- Formats
- In person, live online or in-house at your premises
- Class size
- Maximum 16 students per instructor pair
- Instructors
- Working Aldervane investigators and analysts
- Completion
- Practical assessment and an Aldervane certificate of completion
- Pricing
- Per seat, or a fixed fee for in-house cohorts
Course catalog
Courses built from casework.
Four core courses, an executive briefing and custom programs. Around 60 percent of course time is hands-on work in our training lab, using realistic data sets built from anonymized investigations.
OSINT Foundations
The core method every analyst needs, from turning a question into requirements to writing a judgment someone can act on.
- Intelligence requirements and planning
- Search tradecraft and advanced query syntax
- Operational security and managed attribution
- Capture, hashing and documentation
- Reporting with stated confidence
Advanced Attribution
How our investigators identify the people behind anonymous activity, and how they test their own conclusions before anyone else does.
- Infrastructure pivoting and certificate history
- Identity resolution and username analysis
- Geolocation and chronolocation
- Structured analysis of competing hypotheses
- Red-teaming your own findings
Financial Investigations and Due Diligence
Following ownership and money through registries, courts, vessels and public ledgers, for compliance, investigations and deal teams.
- Corporate registry research across jurisdictions
- Beneficial ownership and nominee detection
- Asset tracing: property, vessels and aircraft
- Blockchain tracing fundamentals
- Sanctions exposure through ownership
Protective Intelligence and Threat Assessment
For security and protection teams who need to assess threats to people and reduce the exposure that enables them.
- Behavioral threat assessment frameworks
- Attributing anonymous threats
- Exposure audits for principals and families
- Advance intelligence for travel and events
Executive Briefing
For leaders who commission or rely on intelligence and need to know what to ask for and how to read what comes back.
- What open sources can and cannot establish
- Reading confidence and probability statements
- Legal and ethical boundaries of collection
Custom programs
Programs built around your cases, your legal environment and your team's roles, from a single workshop to a multi-week academy with mentored live exercises.
- Training needs assessment before design
- Exercises built from your sector's threats
- Optional mentoring on a live case
What you receive
Every student leaves with a method.
Tools change every year. A disciplined method does not. Our courses teach the reasoning first, then the techniques, then the tools that support them.
- Course workbook and method guides to keep
- Access to our training lab environment for the duration of the course
- Realistic exercises built from anonymized Aldervane investigations
- A practical assessment scored by the instructors
- An Aldervane certificate of completion for students who pass
- 30 days of instructor questions and answers after the course
- Task 1Capture and hash the current landing page
- Task 2Extract tracking and analytics identifiers
- Task 3Pivot on certificate and registration history
- Task 4Test one alternative explanation
- Task 5Write two key judgments with confidence levels
How it runs
From needs assessment to follow-up.
Training is most useful when it fits the work your team actually does. We start by understanding that work, and we stay available after the course ends.
-
01 / Assess
Two weeks before
We review your team's roles, experience, typical cases and legal environment, and adjust exercises to match.
-
02 / Teach
Course days
Short instruction blocks followed by hands-on lab work, with instructors reviewing each student's method as they go.
-
03 / Assess
Final day
A timed practical exercise, scored on method, evidence handling and the quality of the final judgments.
-
04 / Follow up
30 days after
Instructors answer questions as students apply the method to their own work, with optional mentoring on a live case.
How we teach
Taught the way we work.
Our courses follow the same standards as our casework. Students learn to collect lawfully, preserve everything and say only what the evidence supports.
- Built from real casesExercises are reconstructed from closed Aldervane investigations, with identifying details removed and synthetic data in their place.
- Method over toolsWe teach why a technique works and when it fails, so students can adapt when sources and tools change.
- Operational security firstStudents learn to protect themselves, their organization and their investigation before they run a single search.
- Lawful and ethical by designEvery module covers the legal and ethical limits of the techniques it teaches, including where we draw our own lines.
- Small classesNo more than 16 students and two instructors, so every student's method is reviewed, not just their answers.
- Working investigatorsInstructors rotate in from live casework, so what they teach reflects what is working on investigations right now.
- Assessed on practiceCertificates are earned through a practical exercise, not attendance. Not every student passes on the first attempt.
- Tool-agnosticWe do not sell software in our courses. Techniques are taught with freely available methods your team can use immediately.
Results
What changes after the course.
We measure training by what teams do differently afterwards, not by how many people attended.
Our analysts came back writing reports differently. Every judgment now carries a confidence level and a source trail, and our prosecutors have noticed.
The attribution course was the first training where the exercises felt like real cases. That is because they were real cases, with the names taken out.
Questions
Training FAQ
Do you teach specific software tools?
We teach techniques, and show them with freely available methods. Where your team already uses particular tools, in-house programs can include exercises that apply the method within them.
Is the certificate an external accreditation?
No. Students who pass the practical assessment receive an Aldervane certificate of completion. It records the course, the date and the result. It is not an accreditation issued by any outside body.
Do you train government and law enforcement teams?
Yes. We regularly deliver in-house programs for government, law enforcement and prosecution teams, adapted to their legal powers, disclosure obligations and evidence standards.
Are there prerequisites?
OSINT Foundations and the Executive Briefing have none. Advanced Attribution assumes Foundations or equivalent experience, which we confirm with a short pre-course questionnaire.
How do we book a course?
Start with a briefing. We will confirm the right course or program, the format and the dates, and send a written proposal with a fixed fee.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.