Defensive OSINT, hybrid security and intelligence applied to operational risk.
Professional portfolio of assessments, security plans and intelligence analysis for environments where physical and digital risk are no longer separable. Regulatory framework: Spanish Laws 5/2014 and 8/2011, ISPS, NIS2 and IEC 62443. No marketing, no smoke, no cyberpunk aesthetics.
Specialisation areas.
Active technical disciplines. Individual work, no subcontracting, full traceability of the methodology applied.
Defensive OSINT
Passive reconnaissance of the exposed surface of people, brands, domains and infrastructure. Focus on what an adversary sees, not on what the organisation thinks it shows.
Hybrid physical-digital security
Integrated analysis of physical, human and digital vectors. Access control, personnel OSINT and OT segmentation are the same problem.
Critical infrastructure
Operator Security Plans (PSO) and Specific Protection Plans (PPE) under Spanish Law 8/2011 and RD 704/2011. Water, energy, transport, logistics.
Operational risk
P×I evaluation on process threats: sabotage, human error, single-supplier dependency, non-redundant shifts, supply chain.
Social engineering
Realistic pretext modelling against executives, middle management and operators with access to critical systems. Personal-exposure analysis in open sources.
Vulnerability assessment
Inventory of observable attack surface: domains, subdomains, certificates, historical leaks, metadata, personnel and vendor exposure.
OT / SCADA security
IEC 62443 applied to industrial environments: zoning, conduits, IT/OT segmentation, patch governance and privileged-access traceability.
Threat assessment
Structured threat modelling (STRIDE, OWASP, ISO 31000) with a probability/impact matrix and a mitigation plan prioritised by time horizon.
Applied security intelligence
Analytical reading of context, weak signals and adversary behaviour. Intelligence precedes the technical measure, never the other way around.
Case studies.
Real reports, anonymised and stripped of any sensitive element. What remains is the method, the findings and the operational reading. Access to the full PDF under verified email, with individual traceability.
Brand impersonation, fraudulent infrastructure and Sha Zhu Pan scheme
Active fraudulent domain impersonating a consumer-electronics multinational present in 15+ countries. The visible layer concealed a financial-fraud infrastructure with JWT linkage to winaopp.com, TRON receiver wallets and a money-mule network. Passive investigation only.
CIA Triad maturity analysis: gaps, attack surface and prioritised plan
Structured evaluation of confidentiality, integrity and availability on an organisation with on-prem + cloud infrastructure (M365, AD, VPN). Average score 4.5/10 — insufficient versus minimum GDPR standard. Availability is the immediate critical area; confidentiality carries the highest regulatory exposure.
Threat framework on an e-commerce platform with payment gateway
Structured analysis of 14 threats on a B2C online store (500–2,000 orders/month, 15,000 records). Four critical ones concentrated in payment fraud, checkout injection, card-data exfiltration and identity spoofing. Significant exposure to PCI DSS v4.0 and GDPR.
Security Plan — WWTP Litoral Sud (Water sector / CI)
Operator Security Plan (PSO) — basis for a Specific Protection Plan — over a wastewater treatment plant classified as critical infrastructure within the water sector. Covers physical security, OT/SCADA cybersecurity under IEC 62443, hazardous-substance management (chlorine, hypochlorite, biogas), vigilance organisation and contingency/emergency plans.
itradeinvestment.com — Pig Butchering scheme, regulated fintechs as a vector and cross-border mule network
Intelligence analysis of a fraudulent investment platform combining romance-based social engineering (Pig Butchering), the instrumental use of regulated fintechs (Revolut, Wise, N26) as a laundering layer and a cross-border mule network to move funds toward crypto exchanges. The investigation reconstructs the criminal flow end-to-end: targeting, persuasion, deposit, exfiltration and footprint erasure — with no active interaction against the actor's infrastructure.
Operation Atlas — OSINT due diligence of a strategic vendor prior to a multi-year contract
Independent reputational assessment of a European vendor candidate to a multi-year technology services contract (€3.6M over 3 years) with access to production infrastructure and sensitive data. Eight-layer OSINT-only due diligence surfaced six undisclosed material signals: opaque UBO across two jurisdictions, undisclosed director track-record with four dissolved entities, nine-month-old corporate domain with inconsistent narrative, postal address shared with 47 entities and a civil claim in the same sector. Medium-high risk. The client halted signing; the vendor withdrew after documentary requirements.
Operation Vertex — UAS-incursion exposure assessment over a logistics facility
EU logistics operator with multitenant campus and high-unit-value goods. After a documented regional UAS incursion on a comparable facility, independent eight-layer assessment (OSINT + perimeter observation + regulatory analysis + threat-type modelling). Seven viable aerial vectors for C1/C2/C3-class UAS and six material findings: blind detection below visual line-of-sight, 14–22 min reaction time vs 3–8 min hostile operational window, five vectors uncovered, no formal AESA escalation protocol and no counter-UAS training. Aggregate risk high. Recommendation: multimodal detection, documented protocol and law-enforcement liaison — no autonomous active mitigation given the regulatory frame (RD 1180/2018).
Multipurpose port terminal — Operational exposure and hybrid-vector assessment
Independent intelligence assessment of a European multipurpose port terminal after a series of documented sector-wide incidents (unauthorised cargo extraction, document tampering and unidentified aerial approaches). Multi-intelligence fusion: OSINT + GEOINT + perimeter IMINT + structured HUMINT under anonymisation protocol. Several viable operational vectors and material findings grouped in four families: incomplete perimeter coverage, documentary traceability of subcontracted personnel, concentrated technological dependency without OT/IT segregation and no protocol for emerging threats. Aggregate risk high. All differentiating details (location, traffic, client, dates, exact magnitudes) have been removed or generalised.
Methodology.
A reproducible technical sequence, not a sales process. Each phase produces auditable evidence that feeds the next.
- 01
OSINT reconnaissance
Passive inventory of the exposed surface. No active interaction with systems.
- 02
Exposure surface
Mapping of assets, identities and providers observable from outside.
- 03
Risk evaluation
P×I matrix under ISO 31000. Prioritisation by operational consequence.
- 04
Vulnerability identification
Technical, organisational and human gaps. Cross-pillar mapping.
- 05
Hybrid physical-digital analysis
Integrated reading: perimeter, access control, OT, personnel OSINT.
- 06
Technical recommendations
Verifiable measures aligned with regulatory framework and sector standards.
- 07
Mitigation plans
Horizons 0–30 days, 1–3 months, 3–6 months. Cost/benefit made explicit.
- 08
SOPs and incident response
Operational procedures, normalised escalation and continuity plan.
Differential approach.
Zero101OSINT is not generic technical OSINT. It is the combination, in a single individual, of real operational experience in public and private security, intelligence analysis and technical discipline applied to critical environments.
More than three decades in public and private security. Vigilance, access control, sensitive environments and habilitated security direction under Spanish Law 5/2014.
The same analysis covers the physical perimeter, human behaviour, the OSINT surface and the OT/IT architecture. Not delegated to three separate vendors.
Work framed within Spanish Laws 5/2014 and 8/2011, RD 704/2011, ISPS Code, NIS2, ENS, IEC 62443, ISO 31000, ISO 22301, GDPR/LOPDGDD.
Passive analysis, bounded scope, no absolute promises. What is documented is what has been verified, with method limitations made explicit.
Sectors.
Environments where the analysis has produced deliverables or where the technical profile applies directly.
Terminals, concessions, ISPS, maritime supply chain.
Water, energy, telecommunications under Spanish Law 8/2011 and NIS2.
OT/SCADA environments, ATEX, hazardous substances, process continuity.
Transport operators, logistics platforms, cargo control.
Threat modeling, PCI DSS, payment fraud, checkout protection.
Executive OSINT exposure, vendor risk, due diligence.
Technical support to security directors, service managers and operators.
Services under NIS2 / ENS: incident notification, resilience and traceability.
Request a confidential assessment.
For companies, facilities, operators and organisations that need to understand their real exposure before investing in measures. Bounded scope, traceable deliverable, confidentiality by default.
- ·Passive analysis, no active interaction with the evaluated systems.
- ·NDA available. All communications through verified channels.
- ·Technical deliverable, anonymisable for internal or audit use.