Hostile states are exploiting public information. UK organisations must respond

Jack Borthwick is account director for Europe, the Middle East and Africa at Fivecast, a provider of AI-enabled open-source intelligence solutions.

Modern grey-zone warfare extends far beyond cyber-attacks and espionage. Hostile states are using social media, online forums and public information to gather intelligence, influence public opinion, target organisations and operate below the threshold of armed conflict.

These actors exploit digital environments to map relationships, understand organisational structures and support operational planning. Their intelligence services are increasingly using publicly accessible data, false personas, commercial datasets and publicly available information to identify recruitment opportunities, target opponents and build networks of influence or division.

This activity is sophisticated and has implications not only for government and defence, but for businesses, universities, local authorities and operators of critical infrastructure, including telecoms providers.

These sectors remain exposed because they combine strategic importance, operational dependence and public visibility. Universities face additional challenges due to international collaboration, open research environments and access to sensitive intellectual property.

Disrupting infrastructure can generate immediate impact, but infiltrating research environments may deliver longer-term strategic advantage.

As tensions increase, there are growing instances across the UK and Europe of hostile states using criminal proxies to conduct sabotage, arson and other low-complexity attacks against political figures, critical infrastructure and soft targets.

As a society, we are not powerless. There are early warning indicators embedded within large volumes of fragmented data, if organisations are equipped to detect them.

Using AI and open-source intelligence to detect threats

AI, applied to open-source intelligence tradecraft, provides that capability. Harnessed to open-source intelligence (OSINT) workflows, it enables organisations to identify their digital exposure, spot emerging threats and monitor activity that is directed towards their operations, critical infrastructure or workforce.

By connecting disparate data at scale, advanced analytics reveals coordinated behaviour and surfaces signals that would otherwise remain hidden. It identifies suspicious patterns, detects indicators of hostile reconnaissance and builds a clearer understanding of how cyber, physical and information threats intersect. This early visibility enables organisations to make faster, more informed decisions and mitigate risk before it escalates into disruption, espionage or sabotage.

Strengthening collaboration between government, critical national infrastructure operators, academia and the private sector will be essential. By sharing intelligence and developing a common operating picture, organisations can improve collective resilience, enhance risk management, and respond more effectively to emerging threats.

By connecting data across multiple sources, OSINT enables organisations to move from passive awareness to early threat detection and make faster, more informed decisions.

Defence and deterrence are far more effective when organisations have those critical early warnings that enable them to reduce adversary opportunity before operational impact is achieved.