Start with something you care about
Forget the hoodies and scrolling green text for a minute. Your email, your business, the files you cannot afford to lose: cybersecurity is about reducing the chances of someone stealing, changing or breaking those things. And being able to recover when something does go wrong.
That includes fairly ordinary work. Knowing who still has access. Updating a service. Trying a restore before you need one. A brilliant security product is not much help if the only person who can recover the account left six months ago.
OSINT is where curiosity gets useful
OSINT means open-source intelligence: turning publicly available information into something you can actually use. Here, “open source” means accessible sources, not necessarily open-source software. A website, a public document, DNS records or a job advertisement can each tell you a little.
The interesting part is the connection. An old product page mentions a service nobody remembers. A public certificate gives you another name to check. Neither proves a vulnerability. Together, they give you a better question to ask the team. That is much more useful than collecting ten thousand results and calling it intelligence.
Curious does not mean careless
Write down where a clue came from and when you found it. Separate what you saw from what you think it means. Public information can be outdated, misleading or about a completely different company with a similar name.
And keep a boundary: researching public information is not permission to test someone else’s systems or assemble dossiers on people. Start with your own footprint. You will probably find enough unfinished housekeeping there to stay busy.