Open-source intelligence has always leaned heavily on social media, and X (formerly Twitter) remains one of the highest-signal public sources a security team can watch. Threat actors leak samples and brag about breaches there.
Brand-impersonation and phishing lures surface there first. Hacktivist coordination, credential-dump announcements, and early chatter about a fresh CVE all show up in public posts before they reach any structured feed. The hard part in 2026 is not deciding that X data is useful for threat intelligence. It is collecting it reliably and at a price that fits a security budget rather than an enterprise data contract.
This article covers how blue teams and OSINT analysts pull X data today, what changed in the platform’s access model, and the collection practices that keep a monitoring pipeline stable.
For teams that just need the collection layer, a managed Twitter scraping API like GetXAPI provides per-call access to public posts and profiles; the rest of this article covers the monitoring practices you build around it.
What security teams actually monitor on X
The use cases cluster into a few repeatable patterns:
- Brand and executive impersonation. Fake support accounts, spoofed executive profiles, and phishing lures that ride on a company name. Catching these early depends on continuous keyword and handle monitoring.
- Leak and breach chatter. Threat actors and resellers often post teasers or samples publicly before a full dump lands elsewhere. Watching specific keywords, hashtags, and known accounts surfaces these fast.
- Vulnerability and exploit signal. Security researchers frequently discuss new CVEs and proofs-of-concept on X before vendor advisories circulate widely.
- Campaign and narrative tracking. Coordinated inauthentic behavior, hacktivist mobilization, and disinformation campaigns leave a measurable footprint in posting patterns and account networks.
Every one of these is a data-collection problem first. You need a stable way to search public posts by keyword and operator, pull the timelines and profiles of accounts of interest, and page through results at volume without your pipeline breaking.
What changed in platform access
The collection landscape shifted hard between 2023 and 2026. X removed its free API read tier in February 2023, and in February 2026 it moved to pay-per-use pricing while closing its older Basic and Pro subscription tiers to new signups.
Under the current published rates, a standard post read costs $0.005, which turns a continuous monitoring workload of a few million reads a month into a five-figure line item. For a security team running OSINT as one function among many, that pricing rarely survives budget review.
The practical response has been to collect through third-party data providers that expose public X data via simple REST APIs, priced per call. GetXAPI, for example, returns public tweets and profiles at roughly $0.001 per call, with each search call returning about 20 posts and no developer-account application in the way.
The same monitoring workload that would run into five figures on official pay-per-use rates lands in the tens-to-low-hundreds of dollars per month, which is what makes always-on collection realistic for a security function.
Building a stable collection pipeline
The mechanics of a monitoring pipeline are straightforward, but a few practices separate a pipeline that runs for months from one that silently breaks:
Scope queries tightly. Combine keywords with operators, language filters, and date bounds so you collect signal rather than noise. A precise query for a brand term plus known lure phrases will surface impersonation attempts without drowning analysts in unrelated mentions.
Separate discovery from enrichment. Use search to discover accounts and posts of interest, then pull full profiles and timelines only for the accounts that matter. This keeps call volume, and cost, proportional to genuine signal.
Persist raw responses. Store the raw JSON as it arrives. In an investigation you will want fields you did not think to parse at collection time, and deleted posts you captured earlier become evidence.
Pace your requests and handle throttling. Any collection at volume needs backoff logic. Batch politely, watch for HTTP 429 responses, and back off exponentially rather than hammering an endpoint. A short primer on how to handle rate limits and read the retry headers will save you from the most common cause of a monitoring job stalling out.
Record account state. When a monitored account is suspended, protected, or deleted, log the transition. For tracking a threat actor over time, the moment an account goes dark is itself intelligence, not a gap to silently skip.
Operational and legal notes
Collecting public data is not the same as collecting it responsibly. Restrict monitoring to genuinely public posts, keep collection proportional to a stated security purpose, and document your access channel and retention policy the same way you would for any evidence-handling process.
If collected data feeds an investigation that could become legal, chain-of-custody discipline on your stored responses matters as much as the collection itself.
The takeaway
X remains a first-class OSINT source for threat intelligence, and the collection problem that priced many teams out in 2023 has a practical answer in 2026.
Scope your queries, separate discovery from enrichment, pace your requests, and route collection through a per-call data provider whose pricing matches an always-on monitoring cadence. The signal was always public. The tooling to watch it affordably is what finally caught back up.
