Passive OSINT lets red teams map infrastructure, staff, and vendor paths without alerting defenders. Here’s how it works and how to fight back.