Slides and recording for my DEF CON 34 / Recon Village talk:

OSINT Is Still a Thinking Game: Surviving AI Without Losing Tradecraft

Watch the recording: https://www.youtube.com/watch?v=a3kSH59s6q8

Download the slides: DEF CON 34 - Recon Village - Nico Dekens - OSINT is still a thinking game.pdf

The Core Argument

AI is changing OSINT, but not in the simplistic "AI will replace analysts" way.

The bigger risk is quieter:

AI can make weak reasoning look polished, fast, and convincing.

OSINT was never only about finding information. It was about turning incomplete, messy, manipulated, emotional, contradictory, and uncertain information into defensible intelligence.

That requires human judgment.

Why This Talk Exists

We are collecting more than ever and thinking less than ever.

AI did not create that problem. It made it visible.

As analysts increasingly rely on LLMs to triage data, translate language, summarize large datasets, and generate reports, a dangerous pattern can emerge:

  1. The tool produces a plausible answer.
  2. The answer looks authoritative.
  3. The analyst stops checking the raw source.
  4. Confidence rises while verification shrinks.
  5. The output becomes easier to brief than to defend.

That is the "good enough" trap.

Topics Covered

  • Why "Will AI replace analysts?" is the wrong question
  • How AI dependence can weaken critical thinking
  • Evidence poisoning and synthetic consensus
  • The difference between soft cues and hard anchors
  • The danger of treating AI summaries as verified analysis
  • Why raw-source verification still matters
  • How to force second hypotheses
  • How to separate speed from confidence
  • Why teams should audit where AI enters their workflow
  • The OSINT SaaS temptation and the risk of outsourcing thinking
  • Why the future standard should be defensibility over speed

The Defense Framework

The talk proposes four habits for surviving the AI era without losing tradecraft:

1. Read The Raw Source

AI is a map. The raw data is the territory.

Never let a summary become the only thing you inspect.

2. Force A Second Hypothesis

AI tends to give the most statistically likely answer.

Analysts still need to ask:

  • What else could explain this?
  • What would prove this wrong?
  • What am I assuming without realizing it?

3. Separate Speed From Confidence

AI can help with speed.

Humans still owe the confidence.

Fast triage is useful, but it is not the same as verified intelligence.

4. Audit Dependence

Keep judgment visible.

Tag what came from raw OSINT, what was AI-assisted, and what was analyst judgment. If a conclusion is challenged later, the reasoning chain should still be visible.

Example labels:

  • [RAW-OSINT]
  • [AI-ASSISTED]
  • [ANALYST-JUDGMENT]
  • [UNVERIFIED]
  • [CONFIDENCE: LOW/MEDIUM/HIGH]

Key Questions

Use these questions when watching the talk, reviewing the slides, or discussing AI-enabled OSINT workflows:

  • Are we using AI to improve analysis, or to avoid the hard parts of analysis?
  • Are analysts reading fewer primary sources?
  • Are reports becoming more polished but less defensible?
  • Are alternative hypotheses disappearing?
  • Can junior analysts explain their logic without the tool?
  • Do we know where sensitive investigative intent goes when we use AI tools?
  • Can we clearly explain how a tool gets its results and what it misses by design?

Who This Is For

This talk is for:

  • OSINT investigators
  • Intelligence analysts
  • Cyber threat intelligence teams
  • Journalists and researchers
  • Fraud and financial crime investigators
  • Law enforcement and government teams
  • Security leaders evaluating AI-enabled tooling
  • Anyone working in an information environment where being fast is rewarded, but being wrong has consequences

Not Anti-AI

This is not an anti-AI talk.

AI can be useful for triage, translation support, clustering, summarization, search expansion, and pattern discovery.

But AI should not quietly replace the parts of intelligence work that make intelligence defensible:

  • Problem framing
  • Source evaluation
  • Verification
  • Hypothesis testing
  • Context
  • Uncertainty
  • Accountability

Further Reading

Contact

Nico Dekens / Dutch Osint Guy