Writing an OSINT Report Decision-Makers Will Use

BY DR. LELAND W. SMITH

An investigation is only as useful as the report that comes out of it. You can find exactly the right information and still fail the client if the person who has to make a decision cannot tell, within a couple of minutes, what you found, how sure you are, and what it means for them. Most decision-makers are busy, and many will never read past the first page.

This guide covers a report structure that works for most OSINT tasks, from a short due diligence check to a longer investigation. It is built on a few principles: put the answer first, separate what you know from what you think, source everything, and keep the supporting detail where it can be checked without getting in the way.

Bottom line up front

BLUF, short for "bottom line up front", is a military writing convention that has spread widely because it works. The idea is simple: the first paragraph answers the question you were asked. Background, method and detail come afterwards.

A good BLUF does three things:

1. Answers the question directly.
2. States your confidence.
3. Says what it means for the reader, or what they might want to do next.

Compare two openings for the same report.

Weak: "This report details research conducted between 3 and 7 March into the background of Harbour Logistics Ltd, using a range of open sources including company registries, news archives and social media."

Strong: "We found no public record of litigation, regulatory action or insolvency involving Harbour Logistics Ltd or its two directors. One director was previously a director of a company that was struck off in 2023 for failing to file accounts. We assess with moderate confidence that this does not indicate a wider pattern, but recommend you ask about it before signing."

The first opening tells the reader what you did. The second tells them what they need to know. If they stop reading there, they still have the answer.

Write the BLUF last, once the rest of the report is finished, and then put it first. That way it reflects what you actually found, not what you expected to find.

Separating findings from assessments

The most important discipline in analytical writing is keeping three kinds of statement apart:

• Facts (or findings): what a source shows. "Companies House lists Jane Doe as a director of Harbour Logistics Ltd, appointed 4 June 2021."
• Assessments: what you conclude from the facts, with a stated level of confidence. "We assess that Jane Doe is likely the person who manages day-to-day operations."
• Gaps: what you looked for and could not establish. "We did not identify the ultimate beneficial owner of the holding company."

Readers are entitled to know which is which. When facts and judgments blur together, a reader may act on your guess as if it were established, and you may not be able to defend it later.

Expressing likelihood and confidence

Vague words such as "possibly", "might" and "could" mean very different things to different readers. Use a defined scale and apply it consistently. A widely used example is the estimative language in US Intelligence Community Directive 203, which runs from "almost no chance" through "very unlikely", "unlikely", "roughly even chance", "likely" and "very likely" to "almost certain". Whatever scale you use, include it in the report so the reader knows what your terms mean.

Likelihood and confidence are different things. Likelihood is how probable you judge something to be. Confidence reflects the quality of the evidence behind that judgment: how many sources, how reliable, how consistent. You can judge something "likely" with low confidence because your sources are thin. Say both.

Rating sources

Some teams grade sources using a system such as the Admiralty Code (sometimes called the NATO system), which rates the reliability of a source from A to F and the credibility of a specific piece of information from 1 to 6. You do not have to adopt a formal system, but you should give the reader some sense of why you trust each source. An official registry entry and an anonymous forum post should never carry equal weight.

Source every assertion

Every factual statement in the report should be traceable to a source the reader can check. In practice that means:

• A reference for each fact, either inline or as a numbered note linked to your evidence log.
• For web sources: the URL, the date and time you accessed it (in UTC), and an archived or preserved copy.
• For documents: the issuing body, the document name or number, and the date.
• For negative findings: which sources you searched, with what terms, and when.

If you cannot source a statement, either remove it or label it as an assessment and explain the reasoning. "It is widely known that..." has no place in an OSINT report.

A structure template

This template suits most reports from two to twenty pages. Shorten it for quick checks and expand the sections for larger investigations.

1. Title block: report title, client or requester, reference number, date, version, author, and a handling or distribution marking if relevant.
2. Bottom line: one paragraph, or a handful of bullets, answering the question.
3. Key findings: three to seven numbered findings, each one or two sentences, each sourced.
4. Assessment: your judgments, with likelihood and confidence, and the reasoning that links findings to conclusions.
5. Gaps and limitations: what you could not establish, which sources you could not access, and anything that would change your assessment.
6. Recommendations or next steps: only if requested or clearly useful. Keep them tied to the findings.
7. Scope and method: the question as tasked, the time period covered, the sources and tools used, and anything out of scope.
8. Detailed findings: the supporting narrative, organised by topic or subject.
9. Appendices: evidence log, timelines, entity charts and copies of key documents.

Notice that method comes after the findings. Reviewers and lawyers will want it, and it must be there, but most decision-makers do not need to read it first.

Appendices and evidence logs

The appendices hold everything that supports the report without cluttering it. The most important is the evidence log: a table listing every item you relied on, with an item number, description, source URL or reference, access time in UTC, capture method, file name and SHA-256 hash. Your footnotes in the body point to item numbers in this log.

Other useful appendices include:

• Timeline: dated events in order, each with an evidence reference.
• Entity chart: people, companies and addresses with the relationships between them, each line labelled with its source.
• Search log: what you searched, where and when, including searches that found nothing.
• Glossary: your likelihood scale and any technical terms.

A good test is whether a colleague could pick up your appendices alone and reproduce your key findings. If they could not, something is missing.

A worked example

Suppose a nonprofit asks whether a prospective donor organisation, "Meridian Futures Foundation", is legitimate before accepting a large gift. You have spent two days researching.

Your draft starts with four pages describing every search you ran. Before sending, you restructure it.

1. Bottom line: "Meridian Futures Foundation is a registered charity with filed accounts for the last four years and no public record of regulatory action. Its largest disclosed funder is a company whose ownership we could not identify. We assess the foundation is very likely a genuine operating charity (moderate confidence), but recommend you ask the foundation to identify the source of the proposed gift."
2. Key findings: five numbered statements: registration details, filing record, trustees, the unidentified funder, and no adverse media found. Each cites evidence log items.
3. Assessment: you explain why the filing history and named trustees support legitimacy, and why the opaque funder lowers your confidence without indicating wrongdoing.
4. Gaps: the funder's ownership, and the fact that you did not search non-English media.
5. Scope and method: moved to the end, condensed to half a page.
6. Appendices: evidence log of 23 items, a one-page entity chart and a search log.

The report is now shorter where it matters and more complete where it counts. The board member who reads only the first paragraph knows what to do; the auditor who reads everything can check every claim.

Common writing mistakes

• Burying the answer. If the conclusion is on page six, many readers will never see it.
• Narrating the process. "First I searched, then I found" is a diary, not a report. Organise by finding, not by the order you worked.
• Mixing fact and judgment. "The director is clearly involved in fraud" combines an unsupported judgment with loaded language. Separate what the record shows from what you conclude.
• Hedging everything. Qualifying every sentence with "may" and "possibly" makes it impossible to tell what you actually think. Use your scale and commit to a judgment.
• Overstating certainty. The opposite problem. "Confirmed" should mean confirmed by reliable, independent sources.
• Jargon and acronyms. Write for the reader, not for other analysts. Define what you must use.
• Unsourced claims. Every fact needs a reference.
• Including irrelevant personal data. If it does not answer the question, leave it out.
• No version control. Date and version every draft, and say what changed.

Ethics and handling

Reports often contain personal data and can affect people's livelihoods and reputations. Include only what the question requires, and be fair to the people you write about: describe what the record shows, avoid loaded language, and note relevant context such as a dispute that was later resolved. Mark the report's sensitivity, limit distribution to those who need it, and agree in advance how long it will be kept. If your report may be relied on in legal or employment proceedings, make sure your method and sourcing would stand up to scrutiny, and say plainly where they would not.

Checklist

1. Write the bottom line last and put it first; it answers the question, states confidence and says what it means.
2. List three to seven key findings, each sourced.
3. Keep facts, assessments and gaps clearly separated.
4. Use a defined likelihood scale and state confidence separately.
5. Give every fact a reference to an evidence log item.
6. Record URLs, UTC access times and preserved copies for web sources.
7. Put scope and method after the findings, not before.
8. Include an evidence log, timeline, entity chart and search log as appendices where relevant.
9. Remove jargon, narrative process and unnecessary personal data.
10. Date, version and mark the report, and control who receives it.