Avencyx OSINT & AI

The problem we solve

The information exists online. The problem is finding it in time, knowing how much you can trust it, and being able to show, later, where it came from and how you reached your conclusion. Improvised searches produce results you cannot reproduce, and AI tools used without verification produce claims that are plausible but unfounded.

Situations we work on in the course:

All cases in the course use synthetic data or public material selected for training. We do not work on real people chosen by participants.

What you will be able to do at the end of the program

At the end of the three days you will be able to:

1. Formulate the investigative question, working hypotheses and a collection plan adapted to the legal limits of your profession.
2. Set up and use a separate working environment that protects your identity, your client and the integrity of the investigation.
3. Identify and query the relevant sources for people, companies, domains, addresses, web infrastructure and documents, across Romanian and European public registers, search engines, social platforms and infrastructure analysis tools.
4. Verify the authenticity, date and location of an image, a video or a document, using metadata, reverse search, geolocation and web archives.
5. Capture and preserve digital evidence with timestamps, checksums and an action log, following good practice for digital evidence (Berkeley Protocol, ISO/IEC 27037), so that findings can be reproduced and defended.
6. Use AI tools for search planning, translation, extraction and structuring of information, checking every result against the original source.
7. Recognize and avoid the risks of AI tools in investigations: hallucinations, prompt injection from the content being analyzed, leakage of confidential data to external services.
8. Write a complete OSINT dossier, with sources, timeline, relationship map, findings, hypotheses and confidence levels, in a form usable by a client, a newsroom, management or a judicial body.

Every outcome is assessed in the final case study. The assessment criteria are published in the "Assessment and certificate" section.

The program: three days, twelve modules, one dossier

Around 70% of the time is hands-on casework. Each day has four 90-minute modules, and each module ends with an exercise whose output goes into the final dossier. The method follows the intelligence cycle (planning, collection, processing, analysis, dissemination) and is aligned with the Berkeley Protocol on Digital Open Source Investigations, the international reference for OSINT investigations whose results must hold up in proceedings.

Day 1 — Method, working environment and sources

Day 2 — Verification, infrastructure and provenance

Day 3 — AI, analysis and the final dossier

Daily schedule (the same on all three days): 09:00–10:30 · 11:00–12:30 · 14:00–15:30 · 16:00–17:30 — four 90-minute modules, with two 30-minute coffee breaks and a 90-minute lunch break (lunch included). The 18 hours (3 days × 4 modules × 90 minutes) are the commercial duration of the program; the course is not subject to a legally imposed minimum duration.

How we work

Cases, not slides. One central case runs through the first two days, and each module adds a piece to the dossier. On the third day you work individually on a new case. Presentations are short and serve the exercises.

A method aligned with the field's standards. The Berkeley Protocol on Digital Open Source Investigations (UC Berkeley Human Rights Center and OHCHR), the Admiralty grading system for source evaluation, structured analytic techniques (analysis of competing hypotheses) and the ISO/IEC 27037 principles for digital evidence are built into the method, not taught separately. You leave with a practice you can describe and justify to anyone who checks your work.

Material with documented provenance. The cases use synthetic identities, companies and documents built for training, or selected and cited public material. We do not investigate real people chosen by participants and we do not use Avencyx client data.

The field's established tools, with no dependence on a vendor. We work with the tools used by internationally recognized investigative teams — from advanced search operators and public registers to Maltego, SpiderFoot, Shodan, ExifTool, the InVID-WeVerify suite, the Wayback Machine and Hunchly — and, for each category, with at least one alternative, so that the method works regardless of the tool. We use the free or trial tiers of the tools; where these do not cover the exercise, the trainer demonstrates with the commercial version.

AI as a verified assistant, not a source. We use language models for four things: search planning, translating and summarizing foreign-language material, extracting entities and data from long documents, and structuring into timelines and relationship maps. The rule of the course: no AI-generated result enters the dossier without being checked against the original source and without that check being recorded.

AI risks addressed explicitly. Invented claims, non-existent sources, hidden instructions in the pages or documents being analyzed (prompt injection), transfer of confidential information to external services, dependence on a single vendor. Participants leave with a written procedure for what they can and cannot put into an AI tool in their work.

AI tools used in the course. Participants may use their own accounts with online AI services; no paid subscription is needed to complete the exercises. Alongside online services, we also work with local AI tools and models, run on the participant's laptop under the trainer's guidance, for situations where information cannot leave the device. Installation and setup take place before the course, following the preparation guide.

What you leave with: the OSINT dossier

The result of the course is not a diploma on the wall but a dossier you built yourself and can use as a template in your next real investigation. The structure is the one we use in Avencyx investigative work, adapted to the participants' professions.

Assessment and certificate

Assessment is based on the OSINT dossier from the final case study, against published criteria. The trainer assesses each dossier individually and provides written feedback within five business days of the end of the course.

The pass mark is 70%. Participants who do not reach it receive detailed feedback and may resubmit the dossier once, within 30 days, at no extra cost.

The certificate is Avencyx Academy's own certificate. It states the syllabus covered, the learning outcomes assessed, the duration and the assessment result, and carries a unique number; its authenticity can be verified on request, by certificate number, at academy@avencyx.com. Participants who do not pass the assessment receive a certificate of attendance, without the pass statement.

What this certificate is not. It is not a nationally recognized qualification and is not issued under a program authorized by a public authority. It does not confer a regulated professional status and does not replace the licenses or attestations your profession requires. Its value lies in the published syllabus, the assessment criteria and the dossier you produced.

Who teaches

Cătălin Pătrașcu — founder of Avencyx, lead trainer

Cătălin has worked in cybersecurity for over 20 years, with experience in cybercrime investigations, electronic evidence, incident response and digital forensics, threat intelligence and SOC/CSIRT operations. He has worked in military, government and international settings, including inter-agency cooperation and capacity-building projects in the field of cybercrime.

He holds internationally recognized certifications (ISC2 CISSP, ISACA CISM, SANS/GIAC GREM, GXPN, GWAPT, EC-Council CEH, CHFI, Mile2 CPTE) and is a cybersecurity auditor attested by DNSC, Romania's National Cyber Security Directorate. He leads Avencyx's investigation, DFIR and threat intelligence work and has delivered training programs for CSIRT teams, law enforcement and private organizations.

Why it matters for this course: the method taught is the method used in real investigations, where results had to withstand scrutiny by other parties. The exercises reproduce situations encountered in practice, with the data replaced by synthetic material.

Co-trainer: an Avencyx co-trainer provides hands-on support throughout the exercises, so that every participant gets help when they need it.

What you need to know and bring

Required knowledge

• Professional experience in which you verify information about people, companies or events: law, investigations, journalism, anti-fraud, compliance or security.
• Everyday use of a browser, documents and spreadsheets. No programming or systems administration knowledge is required.
• Reading-level English: some tools and sources are available only in English.

Equipment

• Your own laptop, with administrator rights, at least 8 GB RAM (16 GB preferred) and 32 GB of free space (64 GB preferred), running an up-to-date Windows, macOS or Linux.
• The ability to install software and create a virtual machine. Work laptops locked down by IT policy are not suitable; we recommend a personal or dedicated device.
• Accounts: an email address dedicated to the exercises and an account with at least one of the AI tools listed in the preparation email. No paid subscriptions are required.

Before the course

• Seven days before, you receive a preparation guide: setting up the working environment, the list of tools, and about 30 minutes of reading.
• A short questionnaire about your profession and the kinds of investigations you do, so we can adapt the examples in the course.

What participation includes

• The participant manual, in a digital version for reference, with access to updates for 12 months.
• The worksheets, checklists and the OSINT dossier template, as working templates you use in your own investigations.
• Three days of work in a small group, with the lead trainer and a co-trainer in the room, and individual written feedback on your final dossier.
• Lunch and coffee breaks on each of the three days.
• The Avencyx certificate, after passing the assessment.

Limits and rules

Open sources, passive collection. The course covers only information that is publicly accessible or legally accessible to the person investigating. We do not teach access to protected accounts, systems or data, circumvention of security measures, interception of communications, or contacting the people under investigation under a false identity.

The limits differ from one profession to another. A lawyer, a private investigator, a journalist and an employee of a public authority have different legal grounds, powers and restrictions for collecting and using information. The course explains these differences at a practical level and helps you document your legal basis for each investigation. It does not provide legal advice and does not replace the opinion of a lawyer or your institution's internal rules.

Data protection. Open-source investigations process personal data. The course covers proportionality of collection, purpose limitation, retention and security of the data gathered, and the situations in which an external AI tool must not receive that data. Participants from professions bound by professional secrecy receive specific guidance.

Admissibility is not guaranteed. The method taught aims at traceability and reproducibility of findings. Whether and how the results can be used in judicial proceedings depends on the procedural framework, on the status of the person who obtained them, and on the assessment of the competent body.

Participant code of conduct. On enrollment, every participant agrees in writing to the following rules: work only on the cases and data provided by the trainers; do not investigate real people during the course; do not use the course environment for personal or professional activities; treat information about other participants and their work as confidential; apply the techniques learned only within the legal limits of your profession. Avencyx reserves the right to decline an application or to exclude a participant who breaches these rules, without refund of the fee.

Participant confidentiality. We do not publish the list of participants and we do not use their names or organizations in promotional material without written consent. Groups may bring together professionals from different fields; what is discussed in the room stays in the room.

Enrollment and terms

Price: EUR 1,000 + VAT per participant, i.e. EUR 1,210 including VAT (standard rate of 21%). Invoices are issued in RON at the BNR exchange rate on the invoice date. The price includes the three course days, the materials, assessment of the dossier with written feedback, the certificate, access to the materials for 12 months, lunch and coffee breaks.

Groups and dedicated editions: for three or more participants from the same organization, or for a full edition delivered at your premises or live online with case studies adapted to your field, request a quote. Dedicated editions can also be organized for bar associations, newsrooms, professional associations or institutions.

How the application works

1. You complete the application form (five minutes): your profession, the kinds of investigations you do, what you want to get out of the course. The form runs in your browser and prepares a structured email to academy@avencyx.com, which you send from your own address; nothing is stored on the site.
2. We check whether the program meets your need and whether you meet the prerequisites. We reply within three business days. If it is not the right course, we tell you directly and, where we can, recommend an alternative.
3. On confirmation you receive a pro forma invoice; payment is by bank transfer. Your seat is reserved when payment is received, in order of confirmation.
4. Seven days before the course you receive the preparation guide.

Selection is not about exclusion but about a coherent group: at most 20 professionals who already work with information and can learn from each other.

Cancellation, transfer and withdrawal

• You can transfer your seat to another person who meets the prerequisites, up to three business days before the course, at no cost.
• You can postpone your participation to a later edition, once, with at least seven days' notice before the course.
• The participation fee is not refunded in case of no-show or cancellation less than seven days before the course; transfer and postponement remain available under the conditions above.
• If Avencyx cancels or reschedules an edition, you may choose another date or a full refund.
• An edition is confirmed at a minimum of 10 participants, at least 10 days before the course.
• Right of withdrawal (consumers). If you enroll as a natural person for purposes unrelated to your professional activity, you may withdraw from the contract within 14 days of your enrollment confirmation, without giving a reason, by written notice to academy@avencyx.com; the amount paid is refunded in full within 14 days of your notice. If the edition starts before the 14 days have passed, by enrolling you expressly request that the service begin during the withdrawal period; in that case, if you withdraw after the course has started, you owe the value of the part already delivered, and once all three days have been completed the right of withdrawal ends. Enrollments made for professional purposes or invoiced to a legal entity are not covered by this right; transfer and postponement above apply to them instead.