Which free public sources are most useful for B2B sales research?

The highest-yield free sources are: LinkedIn (company pages and profiles), Google dork searches (site:, filetype:, intext: combinations), SEC EDGAR (for public companies' filings, executive names, financials), state business registries (for private companies — owner names, registered agent, formation date), Google Maps / Places (for local businesses), and government procurement portals like SAM.gov for federal contract history.

Yes. OSINT by definition uses only publicly available information — data that anyone can access without authentication. Researching a company's structure, leadership, and public statements raises no legal issues. Legal boundaries appear when someone attempts to access non-public systems, circumvents authentication, or collects personal data in ways that violate GDPR or CCPA. Standard B2B sales research from public sources is well within legal bounds.

How do I find the right contact at a company?

Start with LinkedIn: site:linkedin.com/in "[job title]" "[company name]" surfaces relevant profiles. Check the company's own website for team or about pages. For smaller companies, state business registries often list owners directly. SEC filings (DEF 14A proxy statements) list named executives at public companies. Press releases mention executives by name and title. Cross-reference sources to confirm the current title before outreach.

What buying signals should I look for in OSINT research?

Strong buying signals include: recent funding announcements (expansion budget available), active hiring in a relevant department (growth investment), new leadership hires (new executives often change vendors), RFP publications (active procurement), technology stack changes (job postings listing tools), and company moves or facility expansions. All of these appear in public sources — job boards, PR Newswire, EDGAR, government procurement portals.

OSINT for B2B Sales: A Practical Playbook

Q: What is OSINT in the context of B2B sales?

OSINT (Open-Source Intelligence) in B2B sales means using publicly available information — company websites, LinkedIn, government registries, SEC filings, job postings, press releases — to build accurate prospect profiles before outreach. The goal is to understand the company's size, structure, buying triggers, and the right contact to reach, all from open data without paid databases.

By the getdork team — Published June 12, 2026

OSINT (Open-Source Intelligence) for B2B sales means building accurate prospect profiles using only publicly available information — company websites, LinkedIn, government registries, SEC filings, job boards, and press releases — before spending a dollar on a paid database. The public web contains more qualified prospect data than most sales teams realize; the challenge is knowing which sources to check and how to connect the dots quickly.

On this page

What OSINT covers for sales
The public sources that matter most
A practical research workflow
Buying signals from public data
Google dork recipes for prospecting
Ethics and legal limits
FAQ

What OSINT covers for sales

In intelligence work, OSINT refers to collecting information from open, publicly available sources rather than classified or non-public channels. In B2B sales, the same principle applies: gather everything you can learn about a prospect company and its buyers from sources anyone can access — before sending a single email or making a call.

The goal is not to spy; it is to stop wasting the prospect's time with generic pitches. A rep who knows that a target company just hired a new VP of Operations, recently filed an RFP for IT services, and is expanding to a new building sends a fundamentally different (and far better) message than one who knows only the company's name.

OSINT is how you get that context for free.

The public sources that matter most

Source	What you find	Best for
Company website	Products/services, team pages, news, job postings, pricing hints	All stages — always start here
LinkedIn	Org structure, executive names/titles, company size, hiring activity, mutual connections	Contact identification and org mapping
Google dork searches	Published documents, staff pages, email addresses, job listings, press releases across the web	Rapid discovery across domains
SEC EDGAR	Annual reports (10-K), proxy statements (DEF 14A with exec names), 8-K current event filings	Publicly traded companies — financials, leadership, risk factors
State business registries	Registered owner/agent, formation date, address, status for private companies	SMB and private company research
SAM.gov / USASpending.gov	Federal contract awards, past performance, registered vendors	Government sales and competitive intelligence
Job boards	Hiring focus, tech stack, department growth, budget hints from job descriptions	Timing signals and tech intelligence
Press release wires (PR Newswire, BusinessWire, Globe Newswire)	Funding, acquisitions, product launches, leadership changes — with named executives	Event-triggered outreach
Google Maps / Places	Local business locations, hours, reviews, phone numbers for SMB prospecting	Local business lists
NPI Registry (healthcare)	Licensed provider names, specialty, practice address, NPI number for healthcare sales	Medical device, pharma, healthcare IT

A practical research workflow

An efficient OSINT research session for a single prospect account takes 10–20 minutes when you follow a consistent sequence:

Start with the company website. Read the homepage, about page, products/services page, and any recent news. Note the company size, geography, what they sell, and who they sell to. This gives you the vocabulary to use in every subsequent search.
Run a LinkedIn company page check. Confirm employee count, recent hires or departures in the leadership feed, and any notable company updates. The "People" tab shows current employees by department.
Identify the right contact. Use site:linkedin.com/in "[job title]" "[company name]" to find the actual buyer profile. Cross-reference with the company's team or about page to confirm current tenure.
Check for buying signals in public records. Search for funding news on PR Newswire or Crunchbase. Check EDGAR if public. Look at job postings for the department you sell to — a new headcount in IT or operations signals budget and activity.
Find contact information. Use site:company.com intext:"@company.com" to find any publicly listed emails. Check the contact page. Look for the executive in EDGAR proxy statements or conference speaker lists.
Synthesize a first-contact angle. Use one specific, real detail from your research to open your message: a recent hire, a published RFP, a product launch, a challenge mentioned in their own content. Generic openers get deleted; specific openers get read.

Buying signals visible from public data

The best time to reach a prospect is when something in their business has changed and created a new need. These changes show up in public sources:

New executive hire. Executives in the first 90 days change vendors. Watch LinkedIn or PR wires for C-suite and VP hires at target accounts.
Funding announcement. Newly funded companies have budget to spend. Check TechCrunch, press wires, or Crunchbase.
Published RFP. They are actively buying. Find RFPs with filetype:pdf "request for proposal" site:.gov for government or search the company's own site for procurement documents.
Rapid hiring in a department. If a company posts five new engineering roles in a quarter, they are scaling infrastructure — which often creates adjacent needs.
New location or expansion. A new office address in a state business registry or a press release about a new facility signals operational change and potential new purchases.
Technology stack changes. Job descriptions that mention a new tool (migrating to AWS, adopting Salesforce) signal a buying cycle for adjacent services.

Google dork recipes for prospecting

# Find the right decision-maker on LinkedIn
site:linkedin.com/in "VP of Operations" "Acme Corp"

# Find the company team/leadership page
site:targetcompany.com inurl:team OR inurl:leadership OR inurl:about

# Find any publicly indexed email addresses on their domain
site:targetcompany.com intext:"@targetcompany.com"

# Find job postings revealing tech stack and hiring priorities
site:targetcompany.com inurl:jobs OR inurl:careers

# Find press releases mentioning the company across the web
"Acme Corp" site:prnewswire.com OR site:businesswire.com

# Find government RFPs in their sector
filetype:pdf "request for proposal" "managed services" site:.gov 2026

For the full operator reference, see the Google search operators cheat sheet. For the step-by-step guide to LinkedIn specifically, see finding company employees on LinkedIn with Google dorks.

getdork builds the dork queries for you.
Set the domain, title keyword, location, or file type — and getdork assembles the operator string. Free to generate; Pro to run results and export to CSV.

Start free at getdork.com →

Ethics and legal limits

OSINT uses only publicly available data — no credentials, no bypassing authentication, no exploiting vulnerabilities. Every source in the playbook above is accessible to any person without a login. That is the definition of public information.

The legal and ethical boundaries in B2B OSINT:

Do not access private systems. Finding a URL via a dork does not authorize access to protected systems. Pages behind login walls are not public data, regardless of how you found the URL.
Respect GDPR for EU contacts. Individual names and work email addresses are personal data under GDPR. For B2B outreach to EU contacts, ensure you have a lawful basis (typically legitimate interest) and provide an easy opt-out.
Do not republish sensitive information. If your research surfaces accidentally exposed internal data (a spreadsheet left on a public server, an unlisted but indexed page), use it only as context — do not republish or exploit it.
No automated mass harvesting. Manual research is always fine. Building scrapers that hit Google, LinkedIn, or company sites at scale violates those services' Terms of Service and may trigger legal exposure under the CFAA or similar statutes.

Standard B2B sales research from public sources — reading company websites, looking up LinkedIn profiles, checking public filings — is universally lawful and standard practice. The line is crossed when you move from reading public information to accessing private systems or harvesting data at scale in violation of platform terms.

Frequently asked questions

What is OSINT in the context of B2B sales?

OSINT (Open-Source Intelligence) in B2B sales means researching prospects using only publicly available information: company websites, LinkedIn, government registries, SEC filings, job postings, press releases, and public databases like the NPI registry for healthcare. The goal is to build accurate prospect profiles and identify buying signals before outreach — without paid databases.

Which free public sources are most useful for B2B prospect research?

In rough priority order: LinkedIn (org structure, decision-maker identification), the company's own website (products, news, team), Google dork searches (cross-domain document and contact discovery), SEC EDGAR (executive names and financials for public companies), state business registries (private company ownership), and job boards (buying signals via hiring patterns). See the table above for a full breakdown by source and use case.

Is B2B OSINT legal?

Yes. OSINT uses only publicly accessible information — the same data anyone can find by visiting websites, reading filings, or searching Google. Legal issues arise only when someone accesses non-public systems, harvests data at machine scale in violation of platform terms, or collects personal data in ways that violate GDPR or CCPA. Standard manual research from public sources is well within legal bounds in every major jurisdiction.

How do I find the right contact at a target company?

Start with site:linkedin.com/in "[job title]" "[company name]" to find relevant LinkedIn profiles. Check the company's team or about page. For smaller private companies, state business registries often list owner names directly. SEC proxy statements (DEF 14A filings on EDGAR) list named executives at public companies. Press releases cite executives by name and title.

What buying signals should I look for in public data?

The strongest signals are: funding announcements (new budget), new executive hires (first-90-days vendor changes), published RFPs (active procurement), rapid hiring in a relevant department (growth investment), new facility or location (operational expansion), and job descriptions mentioning new tools (active technology buying cycle). All of these appear in public sources without any special access.

Related guides

How to find company employees on LinkedIn with Google dorks — the most productive single OSINT technique for B2B sales.
How to build a local business prospect list in 30 minutes — practical playbook for SMB and local outreach.
How recruiters use Google dorks to source candidates — the same OSINT workflow applied to talent sourcing.
How to find email addresses with Google dork operators — turning public contact pages into actionable outreach data.
How to find RFPs and government contracts — a sourced buying-signal playbook for public-sector opportunities.
What is Google dorking? — the foundational guide to how and why dork queries work.