Various OSInt (open source intelligence) tools can be handy, just as they are on a pen-test.
Besides the usual stuff linked to on the site, you can look for email addresses from their domain(s), Google-dork for file extensions on their site and so on.
Often email addresses are tied to discussion forums and such, though perhaps more of that is Github these days.
One tool (forget the name at the moment) would let you look for social media posts/pics in a radius to a given location, so see what pops up nearby the office. If not from the company, might still be informative of the neighbourhood.
Besides the usual stuff linked to on the site, you can look for email addresses from their domain(s), Google-dork for file extensions on their site and so on.
Often email addresses are tied to discussion forums and such, though perhaps more of that is Github these days.
One tool (forget the name at the moment) would let you look for social media posts/pics in a radius to a given location, so see what pops up nearby the office. If not from the company, might still be informative of the neighbourhood.