Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsOpen-Source Intelligence
Steven Harris brings the mindset of a detective and the precision of a threat analyst to every class he teaches. As a Certified Instructor for the SANS Institute, he leads SEC497: Practical Open-Source Intelligence (OSINT) and SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis, helping students move beyond data collection to uncover hidden narratives behind digital footprints—and leave class confident investigating real-world targets with ethical, professional precision. In his day role as a Cyber Threat Analyst at Protection Group International (PGI), Steven deploys the same tradecraft he teaches—tracking adversaries and advising organizations on how to stay ahead. His mission is to make OSINT practical and empowering—helping students see how open-source data protects people, organizations, and national interests.
Steven’s investigative career began in UK law enforcement, where he served more than a decade as a detective with the Greater Manchester Police and later the North Yorkshire Police Cyber Crime Unit. He led digital investigations into fraud, extortion, and exploitation, mastering the art of turning fragments of online data into actionable intelligence. That experience shaped his transition to the private sector, first as a Senior Open Source Intelligence Specialist at QOMPLX, where he engineered scalable OSINT analytics for enterprise cyber-risk assessment, and later to PGI, where he translates investigative techniques daily into operational intelligence. The lessons from these investigations flow directly into his labs, where students learn to think like investigators—validating sources, mapping digital infrastructure, and drawing actionable conclusions from open data.
He holds the GIAC Certified Incident Handler (GCIH) and GIAC Open Source Intelligence (GOSI) certifications and serves as faculty at the SANS Technology Institute, an NSA Center of Academic Excellence in Cyber Defense and multi-year National Cyber League winner. A former executive board member of The OSINT Curious Project, he has contributed widely to the open-source intelligence community through his blog nixintel.info and several OSINT podcasts.
Steven’s teaching philosophy centers on curiosity as the ultimate investigative tool—every click should have a question behind it. Students often describe his classes as the moment OSINT “clicked” for them—where technical skill meets investigative mindset—and many go on to lead OSINT programs, support incident-response teams, or build investigative units using the same frameworks they practiced in class. Known for his clarity, humor, and hands-on labs, he ensures students can apply what they’ve learned the very next day. Outside of cyber investigations, he channels the same inquisitive energy into travel and puzzles, believing that great analysts are simply great problem-solvers with endless curiosity and the discipline to follow the evidence wherever it leads.
Steven has been amazing throughout [SEC497]. He taught me new skills that will build my confidence. I'll recommend this course to all my colleagues.
[Steven is] cleary enthusiastic about the topic and imparted personal knowledge as well as course content.
Steven is fantastic, very polished and engaging, and has loads of experience that he shares through vignettes.
Here are upcoming opportunities to train with this expert instructor.
Review relevant educational resources made with contribution from this instructor.