How to Write an OSINT Brief: A One-Page Template That Survives Review

How to Write an OSINT Brief

An OSINT brief is the artifact that lets a stranger audit your reasoning. It is short — one page, sometimes less. It is structured — five sections, in a fixed order. It is written in plain language, with inline links to the records behind every claim. The template below is the one that holds up under review.

The brief is the analysis

A common mistake is to treat the brief as a summary of the analysis. It is not. The brief is the analysis. If you cannot write a sentence about what a source means, you have not yet finished reading the source. The writing is the test of the reading.

Tip

The five sections

1. The precise claim

One sentence, written precisely. Not "the company is doing well," but "the company reported $X in revenue for FY2024, a Y% increase over FY2023, in its audited annual filing dated D." The precise version is the only one you can confirm.

The brief should also state what the claim is not. If the claim is "the company delayed the project in Q2," the brief should note that it is not a claim about the cause, not a claim about the project's eventual outcome, and not a claim about the company's overall performance. The negative space is part of the definition.

2. The evidence

Two short lists:

• Supports. Each item is a record (with URL and date) that adds evidence in favor of the precise claim.
• Contradicts. Each item is a record that adds evidence against the claim.

A pile of "supports" with no "contradicts" is a press release, not a brief. The honest thing to do is to include the strongest counter-evidence you found, even if it is just one item. A brief that names the strongest counter-evidence is much harder to dismiss than one that ignores it.

3. The source list with weights

A short table of the sources you actually used, with a label for each:

• Primary, audited, public-interest source (regulator, court, exchange) — strongest single weight.
• Primary, unaudited, in-scope (company filing, statement) — strong on facts the source has no reason to distort.
• Reputable secondary (long-form outlet with a named reporter) — useful, especially when they describe how they got the fact.
• Anonymous or self-published primary (a person's post, a forum) — useful as a lead, weak as a sole source.
• AI summary or model output — never a weight; it is a triage layer, not a source.

Two sources at the top outrank a dozen at the bottom. Three sources at the top, on independent angles, outrank any number lower down. Show your weights in plain language in the brief.

4. The corpus biases

A short paragraph naming the three biggest biases of the corpus and what you did about them. Typical biases:

• Language bias. English (and a few other languages) is over-represented in the corpus. Sources in other languages were missed.
• Recency bias. Recent pages rise to the top of search results. Older primary material is missing unless you go looking for it.
• Survivor bias. Deleted posts, retracted papers, bankrupt companies, and dead domains are not in the search results. The fact that you cannot find them is not evidence that they did not exist.

The brief is the place to say it. "We read 60 of 412 filings; selection bias likely over-represents recent, English-language, U.S.-domiciled sources." A reader will trust the rest of the brief more, not less.

5. What would change my mind

A short paragraph naming the specific kind of evidence that, if found, would change the conclusion. The point of this section is to commit, on the page, to a falsification. A future reader, including you, can come back to this paragraph and check whether the falsification has been met.

A brief that names its own falsification is much harder to dismiss than a brief that does not. The act of writing the falsification forces you to imagine a world in which your conclusion is wrong, which is the most important check on overconfidence.

A worked example

Imagine you are writing a brief on whether a tech company delayed a key product launch. The brief might look like:

Claim. Company X delayed the launch of product Y from Q2 2024 to Q1 2025.

Evidence that supports. SEC 10-K filing dated 2024-08-15 (mentions "shifting launch timelines for product Y"); company blog post dated 2024-09-02 (announces Q1 2025 launch); two industry-analyst notes dated 2024-09 and 2024-10.

Evidence that contradicts. Internal product roadmap dated 2024-04 (still showed Q2 2024); an employee post on a public forum dated 2024-07 (described Q2 2024 as "still on track"); the company's earnings call on 2024-08 (mentioned "no change to the previously communicated timeline").

Sources and weights. SEC filing: primary, audited, public-interest — strong. Company blog: primary, unaudited, in-scope — strong. Industry analyst notes: reputable secondary — useful. Internal roadmap: primary, but unverified provenance — useful as a lead, weak as a sole source. Employee forum post: anonymous primary — useful as a lead, weak as a sole source. Earnings call transcript: primary, public-interest — strong.

Corpus biases. Our search was English-only; we did not check non-English coverage of the launch. The earliest sources are from 2024-08; we have no record of internal discussion from earlier in 2024. We did not speak to current or former employees.

What would change my mind. A primary source from the company (a press release, a regulatory filing, an investor letter) confirming that the launch was on track for Q2 2024 and was not delayed. A regulator's statement that the company misrepresented its launch timeline.

That is the brief. It is one page. It is auditable. A reader can disagree with the conclusion on the basis of the same evidence, and the writer has already done the work of saying so.

What not to do

A few common moves that weaken a brief:

• Length. A brief that runs to four pages is an essay, not a brief. The reader will not find the analysis.
• Vagueness. A claim that says "the company has been having problems" is not a claim that can be confirmed or refuted. The brief should be specific.
• Source-only reasoning. "Three sources confirm" is a count, not an argument. The brief should also name the independence of the sources, the weight of each, and the disagreements.
• Burying the conclusion. A brief that says "and so it seems likely that..." is hiding the conclusion. The conclusion is the first sentence.
• Skipping the falsification. A brief without a "what would change my mind" paragraph is a press release.