A few weeks ago I walked out of a meeting with someone who loves learning as much as I do. The conversation stuck with me, and afterwards I wrote a line in my notes: "I'm always in the process of figuring out what I don't know."

Reading it back, I realized it was more than a passing thought. It's the best description I've found of how I approach this work, and of what this article is really about. I've been chasing the next thing to learn since I was a kid. Looking back, that curiosity is probably how I ended up in OSINT. This is a field where there's always something new to figure out, and for someone who genuinely loves learning, that's the best part of the job.

I've been doing this long enough to have strong opinions. I've been the technical editor on several books, written articles and blog posts, and delivered OSINT training. I spend my days building the tradecraft that allows analysts and investigators to reach the parts of the internet that don't want to be reached. And I still learn something almost every week that makes me rethink something I was sure about the week before. I wouldn't want it any other way.

Be the student in the room

One habit has shaped my career more than any tool or course: I make a point of putting myself in rooms and situations where I'm the student. If I'm always the most experienced person in the conversation, how am I supposed to keep learning?

The same goes for the people I meet. When I talk to a new analyst, I'm curious about two things: what they don't know yet, and what they can teach me. It doesn't matter whether they've been in the industry for three weeks or three decades. Some, fresh out of training, see a challenge the way it looks today, not the way it looked when I first ran into it. Others, with decades behind them, have seen patterns repeat that the rest haven't noticed yet.

Say "I don't know" out loud

I tell people what I don't know all day, every day. Not because I lack confidence, but because I'm confident in both what I know and what I don't. Staying humble while being clear about both is a strength, not a weakness.

"I don't know" opens a conversation. "I know" usually ends one. When I'm honest about the gaps, people share what they've seen, we compare notes, and we both walk away better at our tradecraft. When someone pretends to know, the room goes quiet and the mistakes stay hidden.

This isn't a new idea. In Plato's Apology, Socrates questions the people Athens considers wise and comes away with a simple realization: what makes him wiser isn't knowing more, but recognizing what he doesn't know.

In our work, that honesty is practical. Knowing exactly where your knowledge ends is part of the work product. A report that says "we could not confirm X, and here is why" is worth more than one that fills the gap with confidence. The analyst who clearly marks the edge of what they know is the one I trust.

"'I don't know' opens a conversation. 'I know' usually ends one."— Espen Ringstad

Our knowledge expires fast

In a lot of fields, what you learned stays true for years, sometimes decades. In OSINT, it's months. Sometimes weeks.

Look at Michael Bazzell's OSINT Techniques, probably the most widely used book in our field. It's on its 11th edition. When that edition came out in late 2024, Bazzell estimated about 20% of it was brand new and another 20% had to be updated for changes since the previous edition two years earlier. He also stripped out a lot of material that simply didn't work anymore. The reference book for our profession has to be partly rewritten every couple of years just to stay true.

I see this up close every day. A search technique that worked last month quietly stops returning results. A platform that was open yesterday puts everything behind a login overnight. A tool half the community relied on disappears without warning. None of it comes with an announcement, and if you're not paying attention, you keep trusting methods that stopped working a while ago.

If your workflow still looks exactly like it did two years ago, it's not because nothing changed. It's because you haven't noticed yet.

Unlearning is part of learning

Learning new things is the fun part. Letting go of what you already know is harder. Experience makes you faster. It also makes you more likely to see what you expect to see.

A lot of us learned OSINT when the open web was genuinely open. Profiles were public, search engines indexed most of what mattered, and a solid set of search operators got you a long way. That isn't the internet we work on anymore, but the habits we built back then are hard to shake.

Some of the most important content in the world now lives inside apps like WeChat and Douyin, where a browser never reaches and a search engine never indexes. If you've only ever investigated through a browser, you may not even know that gap is there. Those are the unknowns that matter most: not the questions you can't answer, but the ones you don't know to ask.

What I actually do about it

Curiosity only matters if it changes how you work. A few habits that keep me learning:

• Find rooms where you're the student. Conferences, communities, conversations with people who know more than you about something. There's always someone who knows something you don't, and most people are happy to share it.
• Ask every analyst what they can teach you. Three weeks or three decades in, everyone has seen something you haven't.
• Write down what you don't know at the start of every case. Make the gaps explicit before you start filling them. Then go back at the end and see which ones you closed and which ones you papered over.
• Put an expiration date on your methods. If you haven't re-tested a technique in six months, treat it as a hypothesis, not a fact.
• Review other people's work. Proofreading a colleague's report or reviewing their methods is one of the fastest ways to learn something new yourself.

Still learning

I don't think "fully trained" exists in this field. The platforms change, the adversaries adapt, and the internet looks different depending on where you stand. I'm always in the process of figuring out what I don't know. For me, that has never been a problem to solve. It's the reason I'm here.

So. What is it that you don't know, yet?