Reconnaissance in Cybersecurity: Passive vs Active
Reconnaissance is the information-gathering stage that comes before an attack. MITRE ATT&CK describes the Reconnaissance tactic as the adversary trying to gather information they can use to plan future operations. Passive recon uses public sources and does not touch the target; active recon interacts with it and can be logged.
This guide is written from the defender's side: what is learned, how to see your own exposure the way an outsider would, and how to shrink it. Only test systems you own or have written permission to test.
Updated 3 November 2026
Passive vs active reconnaissance
| Passive | Active | |
|---|---|---|
| Touches the target? | No | Yes |
| Typical sources | Search engines, DNS records, registries, public code, job ads, social profiles | Port and service scans, banner checks, web crawling of the target |
| Leaves a trace for the defender? | Not in your logs | Often, in firewall, IDS and web logs |
| Your defensive move | Reduce what is public | Detect, rate-limit, alert |
| Legal care | Low for public data | Needs authorisation |
What ATT&CK lists under reconnaissance
The ATT&CK tactic page lists techniques including Active Scanning (T1595), Gather Victim Host, Identity, Network and Org Information (T1592, T1589, T1590, T1591), Phishing for Information (T1598), and searching open websites and domains (T1593), open technical databases (T1596) and victim-owned websites (T1594). Use the list as a checklist of what an outsider can learn about you. Source and current list: attack.mitre.org/tactics/TA0043.
See your own exposure
- Look up your domain's records with the DNS lookup: forgotten subdomains and old mail records are common finds.
- Check registration details with the WHOIS lookup: is personal data exposed?
- Run the digital footprint check on yourself or your brand.
- On your own lab network, build scans with the Nmap command builder to learn what a scan reveals and what it looks like in logs.
How defenders reduce the picture
- Remove or protect unused subdomains and services; keep an asset inventory.
- Minimise version banners and detail in error pages.
- Avoid publishing internal names, tools and org charts in job ads and public repositories.
- Alert on scan patterns and rate-limit; train staff to report phishing that asks for information, since ATT&CK lists it as a reconnaissance technique.
Reconnaissance is the first phase of most tests; see penetration testing explained for what follows and red team vs blue team for who does what.
Frequently asked questions
What is reconnaissance in cybersecurity?
Reconnaissance is the information-gathering stage in which an adversary collects data to plan an attack. MITRE ATT&CK defines the Reconnaissance tactic as the adversary trying to gather information they can use to plan future operations. Defenders and authorised testers perform the same work to see what the organisation exposes.
What is the difference between passive and active reconnaissance?
Passive reconnaissance collects information without interacting with the target's systems, for example from public records, search engines and DNS data. Active reconnaissance interacts with the target, for example by scanning its address space, so it can leave traces in logs. Boundaries blur: querying a public database is passive, probing a server is active.
What is OSINT?
Open-source intelligence is information gathered from publicly available sources such as websites, registries, social media and public code. It is used by attackers for planning and by defenders to see their own exposure.
Is reconnaissance illegal?
Reading public information is generally lawful, but active scanning of systems you do not own or have permission to test can break computer misuse laws in many countries. Test only your own assets or those you have written authorisation for.
How do defenders detect reconnaissance?
Active scanning shows up as bursts of connection attempts across ports or hosts, unusual requests to web servers and repeated failed lookups. Passive recon is not visible to you by definition, so the defence is to reduce what is publicly exposed.
What does an attacker learn from reconnaissance?
Domains and subdomains, IP ranges, technologies in use, employee names and roles, email formats, and exposed services. MITRE ATT&CK groups this into gathering victim host, identity, network and organisation information, plus searching open websites, technical databases and the victim's own sites.
How do I practise reconnaissance legally?
On your own domain and lab machines, or on targets that explicitly invite testing. Start with DNS and WHOIS lookups, check your own digital footprint, and build scan commands for a lab network.