How to evaluate an OSINT platform

The demo is built to make the decision for you. A clean map, an entity graph fanning out across the screen, a name in one side and a dossier out the other in seconds. Every serious OSINT platform demos well; that is what the sales engineer is paid for. The questions that decide whether the tool survives real casework are the ones the demo skips, and they are boring on purpose. Here is what to ask once the presenter stops sharing their screen.

Evidence handling and chain of custody

If anything the platform produces might later support a decision someone can contest in court or to a regulator, then how it records evidence matters more than how it finds it. Ask what it captures at collection: the source, the capture time in UTC, who collected it, the method, and a cryptographic hash so tampering is detectable later. Ask whether an export is structured for disclosure or is simply a PDF of screenshots. The reference point is ISO/IEC 27037, and a vendor who has never heard of it has told you something useful.

Audit trails

Who ran which search, and when? A platform that cannot answer that about its own users becomes a problem the first time a data-protection officer or auditor asks. You want a log you can hand over without apologising for it, because that is how you show the tool was used lawfully.

Where your data lives

The question most demos slide past: where is your data processed and stored, and under whose law? If you are an EU organisation, are you the controller and the vendor the processor, and is that written into a contract? A platform hosted outside the EU while ingesting personal data on European subjects is a GDPR conversation before it is a features one. EU hosting and a clear processor agreement are not paperwork for its own sake; they decide whether you can lawfully use the thing you are about to buy.

Source coverage, and whether it admits its sources

Coverage numbers are cheap. "Over five hundred sources" means nothing if the platform will not tell you which it queried for a given result, or when that data was last refreshed. You want to know what it searched, what it skipped, and how fresh the answer is. A tool that hides its sources asks you to put your name under results you cannot check.

Whether it fits how your analysts work

A platform that forces your team to abandon its own process will sit unused once the pilot glow fades. During the trial, put a real analyst on a real task, not the vendor's rehearsed scenario. Count the clicks. See where the data goes when the work is done, and whether your case management can reach it. Fit is unglamorous, and it usually decides adoption.

AI that shows its working

Every platform has AI features now, so they are a weak differentiator and a real risk. One question cuts through: does the AI show its sources, or hand you a confident paragraph you cannot trace? Enrichment that cites the artifact it drew from saves time. A summary with no provenance is a liability with good UX: sooner or later it states something false with total confidence, a tired analyst pastes it into a report, and the mistake carries your letterhead. Insist on AI you can trace, or treat what it says as an unverified lead.

Export and total cost

Two practical points close the list. Can you get your evidence out in a structured, usable form, or are you locked into their viewer? And what is the real price after seats, query caps, add-ons and training, not the headline figure on the quote? A cheap tool nobody can export from is not cheap.

Questions to put to any vendor

Print these and take them to the next demo.

1. Show me exactly what you record for one collected item.
2. Where is my data processed, and who is the controller?
3. Which sources did you search here, and when were they last updated?
4. Can I export this so it survives disclosure?
5. When your AI asserts something, where did it get it?
6. Who can see that I ran this search?

We built Nexus around these answers: integrated chain of custody, provenance on every collected artifact, 28 OSINT tools in one place, and EU (Slovenian) jurisdiction, because these are the things that bit our founders in earlier careers, not because they demo well. That is not a reason to take our word for it. Put every question above to us, read how we answer them on our compliance page, and hold Next Sight to exactly the standard you would hold any vendor selling you a tool your casework depends on.

Frequently asked questions