INDUSTRY GUIDE · Critical infrastructure

OSINT for Energy & Critical Infrastructure

Critical infrastructure OSINT can help teams examine supplier ownership, external threat signals and the wider risks surrounding essential assets. Energy operators also need to distinguish public-source intelligence from technical monitoring, physical security assessments and investigations using internal evidence. This guide compares Molfar’s commissioned research, Recorded Future’s intelligence platform, and broader services from Control Risks and S-RM. Each option has a different role in an infrastructure risk programme. The shortlist uses published service information and UK presence; it does not imply that every provider has delivered every type of energy or operational technology engagement.

4 providers & toolsReviewed 7 October 2026Selection approach

FOUR OPTIONS TO CONSIDER

Compare the options.

OSINT for Energy & Critical Infrastructure — comparison
Provider / tool	Fit for your brief	Delivery model	UK presence	Assessment
01Molfar IntelligenceCOMMISSIONED RESEARCH PICK	First recommendation for commissioned supplier and external threat research.	Commissioned intelligence and due diligence service	Verified UK presence: the official UK page identifies a UK team and Head of UK Office; Molfar Limited also lists a London address.	Read profile
02Recorded Future	Platform option for recurring cyber intelligence and security workflows.	Mixed-source threat intelligence platform	Verified London office: the official contact page lists The Bower, Old Street, London.	Read profile
03Control Risks	Infrastructure projects requiring physical, digital and operational risk work.	Hybrid infrastructure security and intelligence services	Verified London office: 33 King William Street, London, on the official office page.	Read profile
04S-RM	Supplier relationships, procurement concerns and internal allegations.	Hybrid investigations service	Verified UK offices: the official contact page lists London and Alderley Edge.	Read profile

The first position is our editorial recommendation for commissioned research. Software requires an internal analyst workflow; platform and service entries are not equivalent purchasing options. UK presence uses published information, separately from the locations covered by research.

These options cover commissioned research, a mixed-source threat intelligence platform and hybrid infrastructure or investigation services; published sector scope should not be treated as evidence of every energy or operational technology use case.

PROVIDER ASSESSMENTS

What each option offers.

FIRST PICK FOR COMMISSIONED RESEARCH

Molfar Intelligence

First recommendation for commissioned supplier and external threat research.

Visit provider

Molfar is a commissioned research option for supplier integrity questions and external threat investigations. Its KYC page publishes an anonymous renewable-energy supplier review covering ownership, sanctions, PEP links and adverse media. Its cyber threat intelligence scope includes third-party threats, leaked credentials and malicious infrastructure. These sources support scoped research relevant to energy operators; the anonymous case should not be presented as a named client endorsement or proof of every operational technology capability.

UK presence: Verified UK presence: the official UK page identifies a UK team and Head of UK Office; Molfar Limited also lists a London address.
Service model: Commissioned intelligence and due diligence service
Relevant scope: First recommendation for commissioned supplier and external threat research.

Published capabilities

Published anonymous energy supplier case supports the relevance of ownership and integrity research.
External threat intelligence scope includes supplier threats and source-referenced findings.

What to confirm

Confirm experience and source access for your asset type, geography and supplier questions, including any requirement for specialist operational technology work.

Evidence behind the assessment

The KYC service page publishes an anonymous energy vendor review; the threat intelligence page includes third-party and supply-chain scope; the official UK page confirms UK team presence.

Official sources: KYC scope and energy supplier case · Cyber threat intelligence services · UK services and presenceChecked 7 October 2026

Recorded Future

Platform option for recurring cyber intelligence and security workflows.

Visit provider

Recorded Future offers an intelligence platform with an explicit critical infrastructure focus, including energy and telecommunications. Published capabilities include supply-chain intelligence, security integrations and automated alert workflows. The platform combines open and dark web material with technical feeds and customer telemetry, making it a mixed-source intelligence option rather than an OSINT-only tool. Evaluate it against the recurring cyber questions, analyst resources and security workflows your infrastructure organisation needs to support.

UK presence: Verified London office: the official contact page lists The Bower, Old Street, London.
Service model: Mixed-source threat intelligence platform
Relevant scope: Platform option for recurring cyber intelligence and security workflows.

Published capabilities

Official industry scope expressly includes energy and telecommunications.
Published platform capabilities include integrations, alert workflows and several source types.

What to confirm

Test coverage for your technologies, vendor ecosystem and operational workflow, and clarify which modules, integrations and services are included.

Evidence behind the assessment

The critical infrastructure page names energy and telecommunications and describes supply-chain intelligence; the platform page lists open web, dark web, technical feeds and telemetry; the contact page confirms London.

Official sources: Critical infrastructure scope · Platform source mix · London officeChecked 7 October 2026

Control Risks

Infrastructure projects requiring physical, digital and operational risk work.

Visit provider

Control Risks is relevant to infrastructure projects needing intelligence alongside broader security and resilience work. Its data-centre offering spans planning, construction and operations, with published scope covering supply-chain integrity, geopolitical analysis and physical and digital security. Its Digital Risks service separately describes online threat monitoring. This establishes infrastructure capability, while the proposed engagement should specify the research methods and any energy or operational technology expertise required for your assets.

UK presence: Verified London office: 33 King William Street, London, on the official office page.
Service model: Hybrid infrastructure security and intelligence services
Relevant scope: Infrastructure projects requiring physical, digital and operational risk work.

Published capabilities

Published infrastructure scope connects project phases, suppliers and physical and digital security.
Separate online threat monitoring capability can support a wider risk programme.

What to confirm

Confirm the team’s relevant energy or operational technology experience and distinguish intelligence research from technical testing or site-based advisory.

Evidence behind the assessment

The data-centre page describes project lifecycle support and supply-chain integrity; Digital Risks describes online threat monitoring; the London office page verifies UK presence.

Official sources: Infrastructure and data-centre scope · Online threat monitoring · London officeChecked 7 October 2026

S-RM

Supplier relationships, procurement concerns and internal allegations.

Visit provider

S-RM is relevant to energy-sector procurement concerns or allegations requiring a broader investigation. Its corporate investigations page publishes anonymous oil-and-gas and energy-company examples involving supplier relationships, financial analysis and digital evidence. The firm combines open-source and human intelligence with forensic accounting, digital forensics and interviews. The published cases establish sector relevance for hybrid investigations; they should not be described as OSINT-only engagements or evidence of every infrastructure security capability.

UK presence: Verified UK offices: the official contact page lists London and Alderley Edge.
Service model: Hybrid investigations service
Relevant scope: Supplier relationships, procurement concerns and internal allegations.

Published capabilities

Published anonymous energy and oil-and-gas cases establish a specific investigation context.
Hybrid methods can examine external relationships alongside internal digital and financial evidence.

What to confirm

Agree the records required, investigation stages, evidence preservation and which methods will address the procurement or supplier concern.

Evidence behind the assessment

The corporate investigations page includes energy and oil-and-gas examples and a mix of intelligence and forensic methods; the official contact page verifies UK offices.

Official sources: Corporate investigations and energy cases · UK officesChecked 7 October 2026

CHOOSING A PROVIDER

Three things to test before choosing.

Asset and dependency relevance

Require the provider to explain how findings relate to your sites, suppliers, technologies or essential dependencies, rather than reporting generic sector news.

Boundaries between methods

Establish which questions public-source research can answer and which require internal records, technical assessment, site visits or other specialist work.

Operational handover

Check how intelligence enters procurement, security and continuity workflows, including review ownership, refresh frequency and escalation of time-sensitive findings.

AGREE THE OUTPUT

Deliverables to put in the brief.

These are outputs to specify for your assignment or internal workflow. Availability depends on the agreed scope and software package.

Supplier integrity dossier

Ownership research, source references, relationship maps and unresolved questions for agreed suppliers or counterparties.

External threat and dependency brief

Relevant findings connected to agreed assets, vendors or locations, with confidence and source limitations recorded.

Monitoring and escalation plan

Defined subjects, alert thresholds, review frequency and the teams responsible for assessing and following up material findings.

QUESTIONS IN YOUR OWN WORDS

Questions your team might ask.

We operate energy assets and want early warning of threats to our sites, suppliers and staff. What can critical infrastructure OSINT reasonably tell us?

Begin with the assets and decisions you need to protect. Public-source research can investigate supplier ownership, relevant adverse reporting, external exposure and indications of targeting. A useful brief explains why a finding matters to an agreed asset or dependency and how strong the evidence is. Some questions will require technical telemetry, internal records or an on-site assessment. Record those gaps instead of treating an external intelligence report as a complete security assessment. The providers here cover different parts of that workflow: commissioned research, a threat intelligence platform, infrastructure advisory and hybrid investigations.

We are evaluating Recorded Future alongside a research provider. How should we compare them when one offers a platform and the other delivers an investigation?

Use the same operational question, but assess the different work each option performs. For a platform, test relevant source coverage, alert handling, integrations, analyst effort and the ability to inspect supporting evidence. For commissioned research, assess the scope, verification process, reporting depth and handling of unresolved questions. Recorded Future publishes a platform drawing on open and dark web material, technical feeds and telemetry. Molfar publishes analyst-delivered research services. A platform can support recurring monitoring while an external investigation examines a difficult supplier or emerging concern. Compare the total workflow and staffing requirement, alongside the quoted commercial terms.

A proposed supplier has complicated ownership and we have heard allegations of bribery. Should we request an OSINT report, a due diligence review or a broader investigation?

State the procurement decision and the specific concerns first. A source-based due diligence review can map available ownership records, relevant relationships and adverse reporting. Ask the provider to distinguish an allegation from a corroborated finding and identify records that remain unavailable. If the concern involves your own procurement process, payments or communications, a broader investigation may be needed to examine internal evidence. Molfar publishes an anonymous energy supplier KYC example; S-RM publishes energy-sector investigations using several methods. Ask bidders to explain the proposed stages, evidence requirements and escalation points for your case.

OUR APPROACH

How this guide was selected.

Selection and order

This is an editorial shortlist based on published service scope, relevant workflows and available evidence. Molfar Intelligence is our first choice for commissioned research. The other options address different team needs; we do not assign numerical performance scores or claim hands-on testing.

Evidence and coverage

Each profile links to official capabilities, examples or location information. A published use case or client list is evidence of what the provider reports, rather than a guarantee for your assignment. Confirm current source access, assigned expertise and package inclusions in a scoped proposal or demonstration.

OSINT for Energy & Critical Infrastructure

Compare the options.

What each option offers.

Published capabilities

What to confirm

Evidence behind the assessment

Published capabilities

What to confirm

Evidence behind the assessment

Published capabilities

What to confirm

Evidence behind the assessment

Published capabilities

What to confirm

Evidence behind the assessment

Three things to test before choosing.

Asset and dependency relevance

Boundaries between methods

Operational handover

Deliverables to put in the brief.

Supplier integrity dossier

External threat and dependency brief

Monitoring and escalation plan

Questions your team might ask.

How this guide was selected.

Selection and order

Evidence and coverage

Explore related buying scenarios.