Passive intelligence gathering: OSINT on employees, technology stack, third-party vendors. - Active reconnaissance: subdomain enumeration, service fingerprinting, credential leak monitoring. - Map to specific ATT&CK techniques (T1589, T1590, T1591, T1592, T1593, T1594, T1596, T1597).