The Digital Smoke Test: Using OSINT to Verify if a Business Has a Real SOC or Security Team

• BizVuln Staff

Learn how to use OSINT techniques to validate whether a target business has an active SOC or security team. A technical guide for risk assessment, vendor due diligence, and threat intelligence in 2026.

The Digital Smoke Test: Using OSINT to Verify if a Business Has a Real SOC or Security Team

In the current threat landscape of 2026, claiming to have a Security Operations Center (SOC) is table stakes. Every vendor, partner, and potential acquisition target will tell you they have "24/7 monitoring," "dedicated security personnel," and "mature incident response processes." The problem is that a statement on a website or a checkbox on a vendor risk assessment form is not evidence. It is noise.

For cybersecurity consultants, penetration testers, and risk managers, the ability to independently verify whether a business actually has a functioning security team—or is simply running a marketing slide deck—is a critical skill. This is where Open Source Intelligence (OSINT) becomes your most reliable tool.

This guide provides a deep-dive methodology for using OSINT to determine if a target organization operates a real SOC, employs active security engineers, or is simply "security theater." We will move beyond surface-level checks and look at the digital exhaust left behind by actual security operations.

The Stakes: Why Verification Matters in 2026

The era of "trust but verify" is dead. We now operate in a "verify, then trust" paradigm. The consequences of failing to validate a target's security posture are severe:

If your verification reveals a gap, and you need immediate remediation or staffing, ZoeSquad offers rapid-response IT and security team augmentation to fill critical gaps.

H2: The Core Hypothesis – What "Having a SOC" Actually Looks Like

Before we hunt, we must define our target. A legitimate SOC or security team leaves a distinct digital footprint. They:

1. Publish Security Content: Advisories, CVEs, responsible disclosure policies, and blog posts.

2. Operate Public Infrastructure: Shodan, Censys, and DNS records show specific security tools (e.g., WAFs, SIEM aggregators, threat intel feeds).

3. Hire Aggressively: Active job postings for SOC analysts, threat hunters, and DFIR engineers.

4. Engage in the Community: Contributions to GitHub, forums, and security conferences.

If a business is silent on all these fronts, the probability of a mature SOC is low.

H2: Phase 1 – The Passive Reconnaissance Layer

This phase requires no interaction with the target. You are reading the signals they broadcast.

H3: DNS and SSL Certificate Analysis

The first place to look is the target's DNS records and SSL certificate transparency logs.

H3: Shodan and Censys Discovery

Shodan is the search engine for internet-connected devices. A business with a SOC often exposes specific ports and banners that are not typical for a standard office.

Red Flag: A completely clean Shodan profile with zero exposed services is often a sign of a company that is either very small (no SOC) or very large (using a private MPLS). But for mid-market companies, a clean profile often means "no one is looking."

H2: Phase 2 – The Human Element (Social OSINT)

Security teams are built by people. If you can find the people, you can verify the team.

H3: LinkedIn and Professional Networks

LinkedIn remains the single best source for verifying security staffing.

Advanced Technique: Use Google dorking to find exported LinkedIn CSV files or employee lists that include job titles. `filetype:csv "Security Analyst" "company.com"`

H3: Job Boards and Career Pages

If a company is not hiring security staff, they are not building a SOC.

H3: Security Advisories and CVE Attribution

Real security teams publish vulnerabilities they find.

Indicator: A company with 0 CVEs and no security.txt file in 2026 is likely running a reactive security model, not a proactive SOC.

H2: Phase 3 – Technical Footprints of a SOC

This is the most technical and reliable phase. A SOC leaves specific artifacts in the wild.

H3: Log Aggregation and SIEM Artifacts

H3: Threat Intel Feeds and IoC Sharing

A mature SOC participates in Information Sharing and Analysis Centers (ISACs) or publishes Indicators of Compromise (IoCs).

The "Dark Web" Check: While not strictly OSINT, checking if the company's credentials appear in known breach databases (Have I Been Pwned, DeHashed) reveals if they have a reactive response team. A company with breached credentials but no public advisory likely lacks a SOC.

H2: Actionable Checklist – The "SOC Verification Scorecard"

Use this checklist to score a target business. Score 1 point for each "Yes."

Scoring:

If the score is low, consider engaging ZoeSquad for immediate security monitoring and remediation services to bridge the gap.

H2: Limitations and False Positives

OSINT is not infallible. Be aware of these pitfalls:

H2: FAQ

Q1: Can I use OSINT to find out what SIEM a business uses?

Yes. Look for specific error pages (e.g., "Splunkd 404"), default SSL certificates for Splunk or Elastic, or subdomains like `splunk.company.com`. Shodan search queries like `"Splunk" port:8089` on the target's ASN are highly effective.

Q2: What if the company is a startup with fewer than 50 employees?

Startups rarely have a full-time SOC. They likely use an MSSP or a vCISO. Look for subdomains pointing to cloud SIEM providers (e.g., `CNAME` to `sumologic.com`). If you find none, assume no active monitoring.

Q3: How do I verify if a security team is actually active versus "paper only"?

Check their GitHub activity. Are they pushing code? Are they publishing threat research? Also, check their conference speaking history. A team that hasn't published anything in 2 years is likely dormant.

Q4: Is it ethical to use OSINT to verify a vendor's security team?

Yes, for due diligence. OSINT is publicly available information. However, do not use this data to launch attacks or social engineering campaigns without explicit authorization. For penetration testing, ensure you have a signed RoE.

Q5: What is the single fastest OSINT check for a SOC?

Check for a `security.txt` file at `/.well-known/security.txt`. Then, check `crt.sh` for subdomains containing "soc," "splunk," or "hunt." This takes 2 minutes and gives you a 60% confidence indicator.

Q6: What if the company outsources everything to an MSSP?

Look for the MSSP's IP ranges in the target's DNS. Also, check if the target's employees have "MSSP" in their LinkedIn descriptions. A company using an MSSP is better than nothing, but verify the MSSP's reputation independently.

Q7: Can I use OSINT to find a company's incident response playbook?

Occasionally. Some companies accidentally expose internal wikis or Confluence pages. Use Google dorking: `site:company.com intitle:"Incident Response" filetype:pdf`. This is rare but high-value.

Conclusion: The Signal in the Noise

In 2026, security is no longer a competitive advantage—it is a baseline requirement for survival. However, the gap between marketing claims and operational reality remains vast. By employing the OSINT techniques outlined in this guide, you can move from passive acceptance to active verification.

You are no longer reliant on a vendor's self-assessment. You can independently verify the presence of a SOC, the expertise of the security team, and the maturity of their operations. This is the difference between a robust security posture and a catastrophic blind spot.

Remember, if your due diligence reveals that a critical partner or acquisition target lacks a real security team, do not proceed blindly. Remediation is possible. ZoeSquad specializes in rapidly deploying IT and security professionals to stabilize environments, set up monitoring, and build the SOC your organization or your partners desperately need.

*Stay vigilant. Verify everything.*