An intern copies a blank penetration-test template with exploit narrative, proof-of-concept, and CVSS sections for a parks vendor OSINT memo. What should the analyst use instead?
Select an answer to reveal the explanation.
Short Explanation
A pentest template on an OSINT job is like bringing a crash-test checklist to a library research paper. Nobody asked for exploits or scores; they asked where the public facts came from. Use sources, methods, findings, and gaps—the OSINT family, not the attack-report family.
Full Explanation
OSINT reporting documents public-source collection, methodology, sourced findings, and unanswered gaps. When an intern copies a blank penetration-test template with exploit narrative, proof-of-concept, and CVSS sections for a parks vendor OSINT memo, the analyst should switch to OSINT sections—sources, methods, findings, and gaps—because this is not a penetration-test report. The wrong genre manufactures an attack story the city did not authorize.
Keeping exploit and proof-of-concept sections and filling them with guessed vulnerabilities invents attack content. Adding a wireless attack-surface appendix because every OSINT report needs an intrusion score imports offensive scoring into research. Replacing findings with a malware-analysis timeline from an unrelated incident pastes the wrong discipline entirely.
Exam caveat: if a separate authorized pentest exists, it gets its own report under its own rules; do not hybridize templates under a PORP/OSINT label.
Operational check: discard the pentest skeleton, open an OSINT template (sources/methods/findings/gaps), populate only from public artifacts, and omit CVSS/exploit/PoC sections. Keep municipal wording calibrated to what public sources actually show, and record retrieval dates so peers can re-perform the work.