OSINT at a Crossroads: AI, Ethics, and Real-World Impact. A Summary of the 2026 SANS OSINT Summit

The SANS OSINT Summit and Training 2026, held in Amsterdam, and virtually, brought together the world's leading practitioners to address the "third generation" of open-source intelligence (OSINT), an era increasingly dominated by Artificial Intelligence (AI) and complex information operations. As the industry matures, the summit highlighted a critical tension: we have more data and better tools than ever, but the human element of rigorous analysis is being eroded by several factors.

The Evolution and "Discipline of the Mind"

Keynote speakers emphasized that OSINT is currently at a crossroads. Deniz Mykola Dirisu noted that the field has transitioned from traditional government archives (1st Gen) and digital proliferation (2nd Gen) into a 3rd generation characterized by AI-driven capacity and state-sponsored poisoning of information.

Nico Dekens challenged the community to move past what he calls "buttonology," the tendency to rely on automated tools without understanding their underlying logic. He argued that OSINT is a thinking game, not a tool race, and warned that a reliance on AI-generated summaries can lead to "cognitive decline" and the erosion of traditional tradecraft.

The Double-Edged Sword: AI and Automation

The summit showcased the cutting edge of automation while providing stark warnings about its risks:

• Semi-Autonomous Investigations: Roelof Temmingh and Alessandro Montalto introduced Ubiquron, an AI-driven platform that uses agents to conduct multi-round investigations, visit websites, and build knowledge graphs with minimal user interaction.
• The Hallucination Trap: Several speakers demonstrated how AI can confidently fabricate evidence. Nico Dekens shared a case where ChatGPT hallucinated non-existent URLs to support a narrative and even generated a fake image of an Amsterdam street that it later failed to recognize as synthetic.
• Humanitarian Automation: In a powerful session, Oleskii Nabozhniak and Anastasiia Morozova detailed how they used automated pipelines to query leaked Russian datasets, successfully finding leads for 69% of a sample of displaced Ukrainian children.

Modern Threats: From Insider Risks to "Influence as a Service"

The landscape of OSINT is shifting to counter increasingly sophisticated adversaries:

• Insider Threats: Ritu Gill explored the rise of the DPRK IT worker scam, where North Korean operatives use stolen identities and "laptop farms" to secure remote jobs in Western tech companies to fund state programs.
• Weaponized Disinformation: Vlad Rotundu and Carlos Fragoso dissected "Influence as a Service (IAAS)," revealing how actors use micro-targeting, "doppelgänger" websites, and native ads to radicalize online communities and harvest user data for profiling.
• The Exhaustion Strategy: Adversaries are now using "synthetic noise" to flood the internet, intentionally burning out analysts and making it nearly impossible to separate reality from propaganda.

Lessons from the Field: The Value of Mistakes

In one of the summit's most down-to-earth sessions, Lisette Abercrombie advocated for celebrating mistakes as essential learning moments. She shared critical lessons on OPSEC and methodology, including:

• The danger of ad blockers hiding critical investigative data.
• How clicking active hyperlinks can compromise an entire investigation to a suspect.
• The importance of double-checking platform-specific syntax (like the "@" symbol on TikTok) to avoid false "404 not found" errors.

Looking Ahead: Protecting Cognitive Security

The overarching theme of the 2026 summit was the protection of cognitive security. As we face restricted APIs and the potential "death of the open web," practitioners must prioritize provenance over plausibility. The consensus was clear: while we should embrace AI as an accelerant, we must never outsource our judgment to machines.

The human collective, armed with critical thinking and shared ethical standards, remains the most powerful tool in the OSINT arsenal.