Updated: Oct 30, 2019
Corporate profiling is critical part of many investigations. The use-cases are vast including corporate due diligence, pre-hire screening, insider threat identification and more. Learning how to efficiently find and collect information for analysis based on your use case is what this blog post will focus on. There will be a heavy focus on LinkedIn advanced searching & navigating but also look at other data points to support your investigations.
There are some great free and commercial tools available to automate a lot of this process, however in this blog we are focused on how to achieve it manually so we aren't reliant on tools and so we don't exclude investigators through a high-barrier to entry with technical skill requirements.
Having a plan for what to collect is important. There are many aspects that will and will not be relevant for an investigation so this structure is a guide on some of the information points that can tie a strong corporate profile report together.
Now we have an idea of some of the things we want to collect, we need to know where to find the information. We will break this down into each section and look at a sample of some of the data sources you can target. This list is not comprehensive but should provide a start point and a workflow that is repeatable.
The company overview is critical. It is important to understand the company from a macro level before delving deep into other sources. The reason for this is that you will pick up on different bits of information that you may have otherwise brushed over throughout the micro work.
Mapping out a corporate structure is important for understanding how an organisations management and employee structure works. I.e. is corporation middle-management heavy, is it top-heavy, who are the key leaders?
Recruitment pipelines. This is often overlooked particularly for people who may want to understand how to influence an organisation at a grass roots level. Looking at educational institutions can paint a really interesting picture of potential culture, points of vulnerability from outside influence and also geographical aspects to recruitment for an organisation.
For example if you are looking at potential grass-roots influence in an organisation and the majority of the staff come from a particular educational institution it can present opportunities to target either a cultural topic (school comrades & loyalty) or simply messaging at the point of recruitment rather than once a staff member is established in an organisation.
Professional networks are often different to personal ones. They are useful when conducting a comparison between a personal and professional network to identify key connections that may play a part it influencing how a corporation operations due to personal relationships.
This is also important when looking at acquisitions and mergers to understand any underlying risks or threats based on personal influences.
There is three key sub-components to sentiment. What the media is reporting, what the public are reporting through social media at a macro level, and what is happening in a specific geo-location (i.e. for a mining company etc) are very different reporting streams. Collecting information to analyse on each is important.
Often overlooked but very important is mapping out what a corporations technology profile looks like, particularly around where infrastructure resides (data sovereignty considerations etc) and is there any identifying illegal activity such as Torrent downloads occurring on a corporate network that might result in embarrassment.
Advanced LinkedIn Searching
Once we have a good understanding of what we want to collect it's time to get into the details of how we're going to do this.
When we start searching for people on LinkedIn it is often handy to go straight to the right section so that results are not combined. I.e. searching for people doesn't become combined with results of companies.
Going to this URL will allow you to search directly for people:
Once there a great place to start is the "All Filters" button so you can start applying your detailed search criteria and reduce the millions of potential users down to your targeted requirements:
You will now see a bunch of filters that you can start using. However one of the quick/key filter areas for rapid results is not always obvious. Scroll down a little and you will see the following box:
Searching in this filter box will add easy-to-repeat parameters to the URL. For example if you search for "Microsoft" in the Company box it will construct the search URL like this:
You will notice the company=Microsoft part. You can modify this yourself without having to go through the filters box. This can create efficiencies if you are automating scripts. The same concept applies for:
For example if you wanted to script out some searches you could do the following URL to find people who's job title is "Director", had a name of "John Smith", worked at "Microsoft" and attended "Harvard" with the following URL:
Going back slightly you would have noticed that there was already a filter further up to search for company. This other filter allows you to search for someone that is part of a company which has a presence on LinkedIn. Why this is limiting sometimes is that not all organisations advertise their company on LinkedIn but their staff may still advertise that they work there. When you do a search using this box you will have a URL that looks like this:
You should notice the company ID in the URL is 1035. This is the company ID that LinkedIn uses to reference in their database. This can be useful when you are searching for organisations that have the same name or a common name and you want to ensure your searches are tied to a single organisation.
This is an important difference to understand and I recommend you compare both results like below:
Searching using the company=Microsoft approach yielded 241,591 results of personnel.
Searching using the company specific search box at the top and selecting Microsoft as a company yielded 154,686 personnel.
The filters above allow you to search for profile languages which might be important for tying a profile to a potential geo-location. Be aware that when a user creates a profile they have the option to select which countries their profile will be displayed so this is not an entirely accurate representation.
The profile language options are limited though so once you click search you have the option to expand different languages by customising the URL: &facetProfileLanguage=%5B“LANG CODE"%5D
With the following language codes available but hidden:
You can search LinkedIn for people based on a Location filter but this will only allow you to narrow down to the city usually. If you want to find people who have a more granular location within their profile simply search for the location as a keyword instead and you often find a lot more detail.
There is still an advanced search URL that seems to work, although the accuracy of the distance metrics is hard to measure. You can modify the below URL to find people based on distance from a location in theory: - note you need the postcode AND the country code.
https://www.linkedin.com/search/results/people/?countryCode=<2 letter code>&distance=<distance>&keywords=<keywords>&postalCode=<zip/postcode>&title=<job title>
Example to find paralegals who are 30mi from Sydney, Australia (postcode 2000): https://www.linkedin.com/search/results/people/?countryCode=au&distance=30&keywords=legal&postalCode=2000&title=paralegal
Profile to Email Association
A method to validate which profile is associated to an email address can simply be achieved by modifying the following URL:
If you find a profile associated with an email address you are looking for you will be presented with this screen: