Gathering victim organization information means collecting details about how a target is structured and operates. MITRE lists it under Reconnaissance with platform PRE. The page was last modified in May 2026. Details include the names of divisions and departments, business operations, and the roles and responsibilities of key employees.
Four sub-techniques sit under it: physical locations, business relationships, business tempo, and roles.
How attackers use it
MITRE says adversaries may collect this through direct elicitation, such as phishing for information. It may also be exposed in accessible data sets such as social media and the victim's own websites.
The information can lead to further reconnaissance, to setting up or compromising accounts as operational resources, and to initial access through phishing or a trusted relationship.
The sub-techniques map to four questions. Where are you? Who do you work with? When are you busy or away? Who does what? Answers to those help an attacker write a lure that sounds right.
A well crafted lure uses a real project name, a real vendor, and the right manager. Each of those can be learned without breaking into anything.
MITRE links the information to initial access through a trusted relationship. If an attacker learns which department works with which provider, a message that appears to come from that provider is more convincing.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
The usable signal is in the lures. An approach that cites a real project, a real vendor, or the correct person in a given role came from somebody who did their homework. Make it easy for staff to report such messages.
Feedback from staff is the best sensor. Make it easy to report, thank people who do, and share anonymized examples so others learn what a targeted message looks like.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Review public pages, press releases, and job postings for detail that is not needed, such as internal structure and tools.
- Give staff guidance on what to share on social media about work.
- Decide a single route for verifying requests that mention internal processes.
- Make sure access depends on controls, not on knowing who does what.
Run a short exercise: collect what you can learn about your own company from public pages in one hour. Share the result with the team that writes the website and job postings.
Give the website, recruiting, and communications teams a one page guide on what not to publish, and review it when the site changes.
Check your own environment
- Does our website publish an org chart or named list of roles with contact details?
- Do job postings describe internal systems in more detail than candidates need?
- How do staff verify an unexpected request that cites an internal project?
- Where do we report suspected pretexting?
Quick check
Name the four sub-techniques of T1591.
Determine physical locations, business relationships, identify business tempo, and identify roles.
What kind of signal exists for this reconnaissance?
Mostly in later phishing or pretexting that uses accurate organizational detail.
Sources
- MITRE ATT&CK, Gather Victim Org Information (T1591): https://attack.mitre.org/techniques/T1591
