Are security questions secure?

The document explains how OSINT can reveal answers to common account recovery security questions by outlining a typical workflow (target identification, sockpuppet social-media review, public records research, and environmental clue analysis) and presents results from an internal test showing which questions were easily discoverable, guessable, or not found. It concludes with practical mitigations, advising reduced public exposure of personal data, private account settings, unique or fictional answers to security questions, and secure storage of those answers in a password manager.