An investigator working a transnational narcotics case uncovers a suspect's social media accounts. The OSINT is useful -- it confirms an alias, reveals associates, maps a rough travel pattern. But the social media profiles alone do not explain the encrypted phone calls to a numbered account in a free trade zone. They do not reveal that the suspect's vehicle was captured on CCTV at a port facility three times in two weeks. They do not connect the suspect to a shell company that received a flagged wire transfer from a known launderer. And they certainly do not identify the undercover avatar that has been building rapport with the suspect's courier on a darknet marketplace for the past six months.
Each of those intelligence threads -- signals, financial, video, human, advertising -- represents a separate discipline with its own collection methods, analytical frameworks, and operational tradecraft. Individually, each provides a partial view. Fused together, they deliver an operational picture that no single discipline can achieve alone.
This guide examines the six core intelligence disciplines that matter most in modern investigations, explains what each contributes and where each falls short, and makes the case for why multi-source intelligence fusion is not a luxury but an operational necessity.
OSINT: Open Source Intelligence
Open source intelligence is the most accessible and most widely adopted intelligence discipline. It encompasses any information that can be lawfully collected from publicly available sources: social media platforms, news outlets, public records, corporate registries, court filings, academic publications, satellite imagery, forums, and the surface and deep web.
The strengths of OSINT are significant. It is available without legal authorization in most jurisdictions. It can be collected at scale through automated monitoring. It provides real-time visibility into public discourse, social networks, and digital footprints. For many investigations, OSINT is where the first leads emerge -- a suspect's online activity, a company's registration history, or a geographic pattern visible in publicly available data.
But OSINT has inherent limitations that too many agencies ignore. It captures only what people choose to make public or fail to adequately conceal. Sophisticated adversaries practice operational security: they use aliases, avoid social media, operate through intermediaries, and conduct sensitive business through encrypted channels that never touch the open web. An investigation that relies solely on OSINT will map only the visible surface of a network while the operational core remains hidden.
The deeper problem is that OSINT volume has exploded far beyond human capacity to process. A single person of interest may have activity across dozens of platforms, in multiple languages, spanning years of content. Automated web intelligence collection can capture this data at scale, but the value only materializes when OSINT is correlated against other intelligence disciplines that reveal what public sources cannot.
SIGINT: Signals Intelligence
Signals intelligence encompasses the collection and analysis of electronic communications and signals -- phone calls, text messages, email metadata, radio transmissions, satellite communications, and the electromagnetic emissions from electronic devices. In the context of law enforcement and national security, SIGINT typically refers to communications metadata (who called whom, when, for how long, from where) and, where legally authorized, the content of intercepted communications.
SIGINT provides what OSINT cannot: visibility into private communications. When a suspect stops posting on social media and switches to encrypted messaging or burner phones, SIGINT becomes the primary means of tracking communication patterns. Metadata analysis alone -- without access to content -- can reveal organizational structures, meeting patterns, and changes in operational tempo that indicate an imminent event.
Modern SIGINT extends well beyond traditional phone taps. It includes analysis of internet traffic patterns, Wi-Fi probe requests from mobile devices, Bluetooth interactions, and even the behavioral signatures of encrypted communications (traffic analysis can reveal patterns even when content is unreadable). Intelligence agencies operating in counter-terrorism and counter-espionage contexts rely heavily on SIGINT as a complement to other collection disciplines.
The challenge for intelligence fusion platforms is that SIGINT data arrives in specialized formats -- call detail records, packet captures, signal metadata -- that must be normalized, entity-resolved, and correlated with identifiers from other disciplines. A phone number intercepted through SIGINT must be matched against subscriber records, linked to OSINT profiles, correlated with financial transaction records, and mapped against geospatial data to produce actionable intelligence. Without fusion, SIGINT remains a stream of technical data that requires specialized analysts to interpret in isolation.
FININT: Financial Intelligence
Financial intelligence is the discipline of tracking, analyzing, and interpreting financial data to identify criminal activity, terrorist financing, money laundering, sanctions evasion, and corruption. FININT sources include Suspicious Transaction Reports (STRs) filed by financial institutions, wire transfer records, cryptocurrency blockchain data, trade finance documentation, corporate ownership records, and regulatory filings.
The foundational insight of FININT is that almost all serious criminal activity leaves a financial trail. Drug trafficking generates proceeds that must be laundered. Terrorist organizations require funding channels. Corrupt officials accumulate unexplained wealth. Sanctions evaders use shell companies and trade-based laundering to move value across borders. Following the money frequently leads investigators to the center of a network faster than any other discipline.
Modern financial intelligence platforms go far beyond traditional STR analysis. They incorporate real-time transaction monitoring across multiple financial systems, cryptocurrency tracing across blockchain networks, beneficial ownership analysis through corporate registries, trade-based money laundering detection through shipping and customs data, and network analysis that maps the flow of funds through layered structures of intermediaries and shell companies.
Consider a human trafficking investigation. OSINT may identify recruitment advertisements on social media. SIGINT may capture communications between traffickers and victims. But FININT reveals the business model: the pattern of small cash deposits across multiple bank accounts, the wire transfers to recruitment agents in source countries, the payments to corrupt officials, and the real estate purchases that represent laundered proceeds. The financial trail maps the entire organization -- from recruitment to exploitation to profit extraction -- in a way that no other discipline can match.
The fusion imperative for FININT is particularly strong because financial data is only meaningful in context. A wire transfer is just a number until it is linked to a person, connected to a pattern, and correlated against intelligence from other sources that explain its purpose.
VIDINT: Video Intelligence
Video intelligence encompasses the collection, processing, and analysis of surveillance footage and other video sources to extract actionable intelligence. This includes CCTV camera networks, body-worn cameras, drone footage, dashcam video, and publicly available video from social media and streaming platforms.
The transformation in VIDINT over the past decade has been driven entirely by AI. Before machine learning, surveillance footage was a liability as much as an asset -- agencies accumulated vast archives of video that no one had time to review. A single camera generates 24 hours of footage per day. A city-wide CCTV network generates thousands of hours. The data existed, but extracting intelligence from it required human reviewers watching monitors in real time or manually scrubbing through recordings after an event.
AI-powered video intelligence platforms have fundamentally changed this equation. Facial recognition enables identity matching across cameras and locations. Object detection identifies vehicles, weapons, packages, or other items of interest. Behavioral analysis flags anomalous patterns -- a person loitering near a facility, a vehicle making repeated passes, a crowd forming in an unusual location. License plate recognition tracks vehicle movements across an entire city. And multi-camera correlation automatically stitches together a subject's path across different camera feeds, producing a timeline of movement without human intervention.
The value of VIDINT is multiplied dramatically when fused with other disciplines. A facial recognition match from CCTV becomes actionable when correlated with an OSINT profile that provides identity context, a SIGINT intercept that reveals the subject's intent, and a FININT trail that connects the subject to a criminal network. Without fusion, a CCTV image is just a face. With fusion, it becomes a confirmed identity linked to a case, a network, and an operational timeline.
HUMINT: Human Intelligence
Human intelligence is the oldest and, in many ways, the most complex intelligence discipline. It encompasses information gathered through human sources -- informants, agents, undercover officers, diplomatic contacts, and individuals who provide intelligence through direct interpersonal relationships. In the digital age, HUMINT has expanded to include covert operations conducted through virtual identities on social media, dark web forums, encrypted messaging platforms, and other digital environments.
HUMINT provides what no technical collection discipline can: insight into intent, motivation, and decision-making. A signals intercept may reveal that a conversation took place. Financial intelligence may show that money moved. But only a human source inside an organization can report what was discussed at a meeting that was never recorded, what a leadership figure is planning to do next week, or why an operation was suddenly postponed.
The digital dimension of HUMINT has become increasingly important. Law enforcement and intelligence agencies now operate virtual personas -- carefully constructed and managed online identities that engage with targets in digital spaces. These avatars participate in dark web marketplaces, closed forums, encrypted chat groups, and social media communities where targets operate. Managing these virtual identities requires military-grade operational security: consistent behavioral patterns, believable backstories, proper device management, and meticulous compliance logging to ensure operations remain within legal boundaries.
Avatar management at scale is a significant operational challenge. Each virtual identity must be maintained over time, must respond consistently to interactions, must avoid patterns that reveal its artificial nature, and must be supported by a digital backstory that withstands scrutiny. Agencies running multiple simultaneous covert online operations need platforms that manage the lifecycle of these identities -- creation, deployment, interaction logging, compliance documentation, and secure retirement.
The integration of HUMINT with technical disciplines is where investigations reach their highest effectiveness. SIGINT and OSINT can identify a target. FININT can map their financial activities. VIDINT can track their physical movements. But HUMINT provides the contextual intelligence that transforms data points into understanding -- and the covert access that enables operations against targets who would otherwise remain beyond reach.
ADINT: Advertising Intelligence
Advertising intelligence is the newest and least understood discipline in the multi-INT toolkit. ADINT leverages the commercial advertising ecosystem -- the vast infrastructure of ad exchanges, demand-side platforms, data brokers, and mobile advertising networks -- to collect intelligence about devices, locations, behaviors, and patterns of life.
The mechanics are straightforward. Every mobile device with installed applications participates in the programmatic advertising ecosystem. When a user opens an app, a real-time bidding request is broadcast to ad exchanges, containing the device's advertising identifier, precise GPS coordinates, device type, operating system, and often a rich profile of the user's app usage, browsing behavior, and interest categories. This data is generated billions of times per day, across virtually every smartphone on the planet.
Advertising intelligence platforms tap into this ecosystem not to serve advertisements but to extract the underlying data for investigative purposes. The capabilities are significant: tracking a specific device's movements over time through advertising bid stream data, identifying all devices that were present at a specific location during a specific time window, building behavioral profiles based on app usage and browsing patterns, establishing patterns of life through recurring location data, and identifying associations between devices that repeatedly appear at the same locations.
Consider a scenario where investigators know that a meeting took place at a specific restaurant at a specific time, but they do not know who attended. ADINT can query the advertising bid stream for all device identifiers that were present at that location during the relevant time window. Those device identifiers can then be tracked forward and backward in time, revealing where each attendee came from, where they went afterward, what other locations they frequent, and which other devices they are regularly co-located with. Without a single warrant for communications data, the investigative team has mapped the participants and their patterns of life.
ADINT is particularly powerful because the data is generated passively and continuously. Targets who practice rigorous communications security -- using burner phones, encrypted messaging, and operational security protocols -- still carry smartphones with advertising identifiers that silently broadcast their location and behavior to the advertising ecosystem. It is an intelligence discipline that targets often do not know exists and therefore cannot effectively counter.
The Fusion Imperative: Why Single-INT Approaches Fail
Each intelligence discipline provides a specific lens on a target. OSINT reveals the public surface. SIGINT exposes communication patterns. FININT maps financial flows. VIDINT tracks physical movements. HUMINT delivers context and intent. ADINT captures device behavior and location. Each is valuable. None is sufficient alone.
The most consequential investigations -- transnational organized crime, terrorism financing, state-sponsored espionage, large-scale money laundering -- involve adversaries who understand intelligence disciplines and deliberately fragment their activities to avoid detection within any single one. A drug network may use encrypted communications (defeating SIGINT in isolation), avoid social media (defeating OSINT in isolation), use cash and hawala transfers (complicating FININT), and vary routes and meeting locations (complicating VIDINT). But no adversary can simultaneously defeat all six disciplines at once. The fragments they leave across different domains become visible only when fused together.
The investigation that fails because it relied on a single intelligence discipline almost always had access to the missing data -- in a different system, owned by a different team, collected through a different method. The failure was not one of collection. It was one of fusion.
Entity resolution is the technical foundation of multi-source fusion. A phone number from SIGINT, a name from OSINT, a bank account from FININT, a face from VIDINT, a device identifier from ADINT, and an alias from HUMINT must all be resolved to the same real-world entity. This is not a trivial problem. Names are spelled differently across languages and scripts. Individuals use multiple phone numbers, email addresses, and financial identities. Adversaries deliberately create confusion through identity obfuscation.
An intelligence fusion platform that performs autonomous entity resolution across all six disciplines, in real time, across languages and scripts, is what transforms a collection of intelligence fragments into an operational picture. Without it, investigators spend weeks manually cross-referencing spreadsheets and databases. With it, the connections surface automatically, and the investigator's expertise is applied where it matters most: interpretation, judgment, and operational decision-making.
Building a Multi-INT Capability
Most agencies do not have access to all six intelligence disciplines on day one. Building a multi-INT capability is an incremental process, and the practical path depends on an agency's mandate, legal authorities, and existing infrastructure.
Start with What You Have
Every agency has access to at least one or two intelligence disciplines. Law enforcement agencies typically start with OSINT and FININT, since open source data and financial records are available through standard legal processes. National security agencies may have established SIGINT capabilities alongside OSINT. The first step is to ensure that your existing disciplines are being fused effectively, not just collected in parallel.
Add Disciplines Incrementally
The second discipline you add should be the one that fills the most critical gap in your existing capability. If your investigations consistently stall when suspects go dark on social media, SIGINT or ADINT may be the highest-value addition. If you have strong communications intelligence but cannot track physical movements, VIDINT is the priority. If you can identify suspects but cannot map their financial networks, FININT is the gap to close.
Platform vs. Point Tools
Agencies face a strategic choice between assembling a collection of point tools -- one for OSINT, one for FININT, one for VIDINT -- and deploying a unified fusion platform that ingests across all disciplines. Point tools are often easier to procure individually, but they recreate the silo problem at a different level. Each tool has its own database, its own entity model, its own interface, and its own analytical workflow. The investigator is left to manually correlate across tools, which is precisely the bottleneck that fusion is supposed to eliminate.
A unified platform that ingests from multiple disciplines into a single entity model, performs cross-discipline correlation automatically, and presents a fused intelligence picture in one workspace delivers capabilities that no combination of point tools can match. The operational difference is not incremental. It is qualitative: investigators see connections that would never surface through manual cross-referencing, and they see them in minutes rather than weeks.
Invest in People, Not Just Technology
Multi-source intelligence fusion is ultimately an analytical discipline, not just a technology procurement exercise. Investigators need to understand what each discipline contributes, how to formulate intelligence requirements that span multiple disciplines, and how to evaluate fused intelligence products critically. Training, doctrine, and analytical methodology matter as much as the platform itself.
That said, the right platform dramatically reduces the technical barrier. A fusion platform that requires data scientists to operate is a platform that will not be used by investigators. The technology should handle the ingestion, normalization, entity resolution, and correlation automatically, allowing analysts to focus on the investigative questions rather than the data engineering.
The Multi-INT Future
The intelligence disciplines described in this guide are not static. Each is evolving as new data sources emerge, new collection methods become available, and AI capabilities advance. OSINT is expanding to include real-time analysis of encrypted messaging platforms where operational security failures create brief windows of visibility. SIGINT is adapting to a world where end-to-end encryption is the default, shifting emphasis from content to metadata and behavioral analysis. FININT is incorporating decentralized finance and cryptocurrency as mainstream financial channels for both legitimate and illicit activity. VIDINT is moving toward predictive capabilities that anticipate events rather than merely recording them. HUMINT is becoming increasingly digital, with AI-assisted avatar management enabling operations at scale. And ADINT is accessing ever-richer data as the advertising ecosystem expands into connected vehicles, IoT devices, and wearable technology.
The agencies that will have the greatest operational advantage in the coming years are not those with the best capability in any single discipline. They are the ones that can see across all disciplines simultaneously, fusing fragments from every available source into a unified intelligence picture that is greater than the sum of its parts.
The investigator who can only see OSINT is working with one eye open. The investigator who can fuse OSINT, SIGINT, FININT, VIDINT, HUMINT, and ADINT into a single operational picture sees the full landscape -- and acts before the adversary realizes they have been seen.