Top 6 OSINT Tools for Security Professionals 2026

The short answer, by problem. For case-based investigation connecting people, domains and infrastructure, buy Maltego, and test the credit model on its free tier before you commit. For internet exposure research, buy Shodan at a $49 one-time membership, and add Censys if you need history or certificate depth. For enumeration inside a pipeline, run theHarvester, which is free and genuinely maintained. For a broad automated sweep with no budget, run the open source SpiderFoot. For deep subdomain and infrastructure discovery, run OWASP Amass.

Last verified: 18 September 2026. Every tool here was checked this session: commercial availability, published pricing, and for the open source projects, actual repository maintenance status rather than reputation.

Check maintenance status before you check features

OSINT tooling decays quietly. These tools are mostly thin layers over other people's data sources, so when a source changes its API, its terms or its price, an unmaintained tool does not fail loudly. It returns fewer results and reports a clean run. That is the most dangerous failure mode in the category, because an empty result reads as an answer.

That table is why this revision made two changes. Recon-ng has been removed and replaced by OWASP Amass. It has no tagged release and no commit since November 2024, and in a category defined by source churn that is disqualifying for anything you depend on. SpiderFoot stays but with a caveat: the repository is alive and the last tagged release is four years old, so anyone wanting current module coverage is running unversioned code from the main branch.

The commercial product that no longer exists

Previous versions of this page ranked SpiderFoot HX as a commercial tier. It is not purchasable. Intel 471 acquired SpiderFoot in November 2022 and folded the hosted product into its TITAN platform, and spiderfoot.net now returns a permanent redirect to intel471.com. The open source tool was never affected and remains free under the MIT licence.

What was lost is the structure rather than the code. SpiderFoot used to offer the pattern this category needs: free to start, supported hosted edition to grow into. That escape hatch closed, and the upgrade path from the free tool is now a threat intelligence platform purchase.

What closed since 2025

Access restrictions are the defining OSINT story of the last two years, and a toolkit assembled before 2025 is partly broken.

• X and Nitter, August 2026. X Corp sent cease and desist letters to the open source Nitter project on 24 August 2026, demanding a permanent takedown of its instances and code repository. Nitter and XCancel went offline on 25 August and the GitHub project was archived. The project announced on 6 September that it would continue after legal advice and XCancel returned, but the episode is the clearest signal yet that platforms will enforce against scraping frontends regardless of whether the underlying content is public.
• Reddit. The Pushshift API was restricted in 2023, which ended the public archive services investigators relied on for historical subreddit and comment data. Reddit publishes no self-serve rate card for commercial Data API access today; commercial use is contract-gated.
• Metered commercial data. Both Maltego and Censys meter data access in credits on top of the licence fee. That is not a restriction so much as a pricing model, but it has the same practical effect: the number of queries you can run is a budget line rather than a technical limit.

The operational consequence is that OSINT collection capability now needs to be treated as perishable. Audit which of your configured sources are actually returning results on a schedule, rather than discovering the gap mid-investigation.

Two scan datasets, not one

Shodan and Censys scan the same internet and do not see the same thing. Scan cadence, port coverage, banner parsing and enrichment all differ, so a host present in one can be absent or differently characterised in the other. Their heritage differs too: Shodan is banner-first and strongest on devices and industrial control systems, Censys is certificate-first and strongest on web properties and infrastructure relationships.

For ad-hoc research, one is enough, and Shodan's $49 one-time membership is the best value entry point in OSINT. For a programme that reports on external exposure, where a missed asset is the failure mode, running both is a coverage decision rather than redundancy. If that programme is the actual requirement, compare against the external attack surface management tools, which are these datasets with workflow attached.

Where OSINT stops

OSINT is a collection discipline. It is not threat intelligence, which is the analytical product built from collection plus commercial feeds, sharing communities and internal telemetry. It is not attack surface management, which is the operational programme that applies collection to your own estate continuously and routes findings to remediation.

Holding that line matters commercially, because vendors in the adjacent categories sell OSINT collection with workflow attached and price it accordingly. For the analytical layer, see the top 5 threat intelligence platforms. For credential and breach exposure, see dark web monitoring tools. For the wider free tooling picture, see open source security tools.

One legal line worth drawing explicitly

Passive collection from third-party sources and active probing of a target are different legal categories, and several tools here do both. Amass can operate purely from certificate transparency and passive DNS, or it can probe the target directly. The first is open source collection. The second is reconnaissance against a system, and whether you are authorised to run it is a question to settle in writing beforehand.

Three further boundaries apply to any OSINT programme. Publicly available is not the same as lawfully collectable at scale, and collecting personal data about EU or UK residents carries GDPR obligations regardless of source. Automated collection routinely breaches platform terms even when the data is visible to anyone. And the same capability that supports a legitimate investigation supports harassment, so the policy that prevents misuse has to be written down rather than assumed.

How we evaluated

Last verified: 18 September 2026.

This is a research-based comparison, not a hands-on bake-off. It publishes no coverage benchmark, no comparative result count and no head-to-head accuracy claim, because those cannot be produced honestly without running every tool against the same targets under the same authorisation. What it does claim is that the following were checked, tool by tool, on 18 September 2026.

• Commercial availability. Whether each product can still be purchased and from whom. SpiderFoot HX cannot: Intel 471 acquired the project in November 2022 and spiderfoot.net returns a permanent redirect to intel471.com. Maltego has been owned by Charlesbank Capital Partners since April 2023 and has acquired PublicSonar and Social Network Harvester in April 2024 and Hunchly in May 2025.
• Repository maintenance status, measured rather than assumed. For each open source project, the GitHub API was queried directly for the latest tagged release and the most recent push. That is how Recon-ng came off this list, with no tagged release and no commit since November 2024, and how SpiderFoot earned its caveat, with commits in April 2026 but no tagged release since v4.0 in April 2022.
• Published pricing, and its absence. Every price here comes from the vendor's own pricing page. Maltego and Shodan publish full tier pricing and it is reproduced with its units. Censys publishes a free tier and a minimum credit package figure but not tier prices. No number on this page came from a comparison site or an aggregator.
• Metering models. Whether data access is charged separately from the licence, because in this category it usually is. Both Maltego and Censys meter in credits, which makes the published licence fee a floor rather than a cost.
• Data source availability. The access restrictions that shape what these tools can actually reach were checked against primary reporting, including the August 2026 X Corp action against Nitter and the state of Reddit commercial API access.

What we did not do

No vendor paid for placement and there are no affiliate links on this page. Nothing here reports hands-on testing, comparative coverage or result quality measured by us. No collection was performed against any third party in the course of writing this page.

How to read the ranking

Ranking reflects fit for the stated use case, weighted toward three things.

The first is whether the tool is actually maintained, which in this category outranks features. A tool that silently loses sources is worse than a narrower tool that works, because the failure looks like an answer. The second is pricing legibility, including the metering model rather than just the licence fee. The third is whether the tool does its job at depth, since OSINT rewards specialist tools composed into a workflow more than it rewards platforms that claim to cover everything.

One caution applies across the whole list. Every tool here returns evidence that something was true at some point, not ground truth about now. Scan banners go stale, can be spoofed, and can be served by something other than what they claim. Enumeration produces false positives from wildcard DNS and stale records. Treat any single-source finding as a lead to corroborate, and be especially careful in 2026, when AI-generated profiles, imagery and text have contaminated the public sources these tools collect from.