ZeroFox
ZeroFox provides external cybersecurity SaaS that discovers, validates, and disrupts digital threats across social media, dark web, domains, and infrastructure for enterprise and government customers globally.
- Company typePrivate
- Founded2013
- HeadquartersBaltimore, United States
- Headcount501–1,000
- GTM typeB2B
- OfferingSoftware
What ZeroFox does
ZeroFox is an external cybersecurity company founded in 2013 and headquartered in Baltimore, Maryland, that provides digital risk protection through a unified SaaS platform. The platform executes a continuous Discover-Validate-Disrupt cycle across social media, the deep and dark web, domains, app stores, and infrastructure, ingesting 12B+ signals into a data graph and combining large-scale automation with human analyst expertise to identify, validate, and actively disrupt external threats. Core product modules include Cyber Threat Intelligence (with sub-products spanning Dark Web Intelligence, Detections & Investigation, Breach and Extortion Response, Compromised Credentials, Intel Feeds/Briefs, and Intel Search Portal), Attack Surface Intelligence, Brand + Domain Protection, Executive + VIP Protection, and Physical Security Intelligence, augmented by the OnWatch 24x7 managed service and the recently launched ZeroFox AI Analytics capability with Scout AI Assistant.
The company's technology stack integrates AI across multiple modalities — NLP for dark web analysis, computer vision for deepfake detection (via the Reality Defender partnership), anomaly detection for phishing and impersonation, and generative AI for natural-language querying — protected by a portfolio of 19+ granted US patents. A founding partnership with Google Web Risk enables blocking of malicious URLs across 5B+ devices within 15 minutes, supporting the Global Disruption Network's takedown operations with a claimed 99%+ success rate. The platform integrates with 700+ connectors spanning TIP, SIEM, SOAR, and EDR systems, plus direct integrations with social platforms including Facebook, Instagram, LinkedIn, X, YouTube, and Zoom.
ZeroFox generates revenue primarily through 1- to 3-year subscription contracts with pricing tied to the number of protected brands, social media accounts, domains, and takedown request volumes, supplemented by professional services revenue from implementation, configuration, training, managed security, breach response, and incident response engagements. Go-to-market combines direct enterprise field sales with channel distribution through authorized resellers and MSSP partners (notably e92plus in the UK, Ireland, and Benelux). The company serves thousands of organizations across Financial Services, Media and Entertainment, Retail and CPG, Healthcare, Public Sector, Technology, and Legal verticals, with operations in the United States, United Kingdom, India, and Chile. ZeroFox was publicly traded on NASDAQ (ZFOX) before being taken private through a buyout by Haveli Investments in 2025.
ZeroFox firmographics
Firmographics- Name
- ZeroFox
- Legal name
- ZeroFox, Inc.
- Website
- https://zerofox.com
- Company type
- Private
- Founded year
- 2013
- Operating status
- Operating
- Headcount range
- 501–1,000 employees
- Short description
- ZeroFox provides external cybersecurity SaaS that discovers, validates, and disrupts digital threats across social media, dark web, domains, and infrastructure for enterprise and government customers globally.
- Ownership category
- akta.pro rank
ZeroFox industry classification
Industry- Product category
- External Cybersecurity
- NAICS
- Software Publishers (5132), Security Systems Services (except Locksmiths) (561621)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Marketplace & Platform Trust & Safety (Buyer/Seller Abuse) (HDADALAI)
- akta.pro secondary industry
- Spam, Fake Engagement & Content Abuse Prevention (HDADALAG)
Keywords
Where ZeroFox is headquartered
LocationHeadquarters
- HQ city
- Baltimore
- HQ country
- United States
- HQ region
- North America
Offices4 records
Markets served
ZeroFox business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure
Revenue model
- Platform Subscriptions: ZeroFox generates revenue primarily through subscription-based platform access. Customers purchase Platform Subscriptions that grant access to the SaaS security platform during a defined subscription term (1, 2, or 3 years). Pricing is based on service parameters including number of business brands, social media accounts, domains eligible for protection, supported source platforms, and number of takedown requests.
- Professional Services: Additional revenue from professional services including implementation, configuration, training, on-demand investigations, managed security, takedown services, breach-response services, incident response services, and other security advisory or consulting. These are sold separately or on a stand-alone basis through statements of work.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise Platform Subscription |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels6 records
ZeroFox product offering
Product offeringCore offering
ZeroFox operates a cloud-based SaaS external cybersecurity platform that fuses AI, machine learning, and human analyst expertise to identify, validate, and disrupt external threats across social media, the deep and dark web, domains, app stores, and physical locations. Its continuous Discover-Validate-Disrupt cycle enables enterprise customers to discover digital exposure, validate threats through human-in-the-loop analysis, and disrupt adversaries via automated takedowns backed by the Global Disruption Network. Revenue is generated through annual platform subscriptions and separately sold professional services including implementation, training, on-demand investigations, and managed security.
Product overview
ZeroFox offers a unified external cybersecurity platform organized around a continuous Discover-Validate-Disrupt cycle. The core platform is complemented by five integrated product modules: Cyber Threat Intelligence (encompassing Dark Web Intelligence, Detections & Investigation, Breach and Extortion Response, Compromised Credentials, Intel Feeds and Briefs, and Intel Search Portal), Attack Surface Intelligence, Brand + Domain Protection, Executive + VIP Protection, and Physical Security Intelligence. Additional capabilities include ZeroFox AI Analytics with Scout AI Assistant for natural language querying, the Malware + URL Sandbox for threat analysis, and the OnWatch 24x7 managed service. The platform integrates with TIP, SIEM, SOAR, and EDR solutions, and partnerships like Reality Defender add deepfake detection capabilities.
Differentiator
Problem solved
Functional benefit
Brands
- ZeroFox AI Analytics: AI-powered analytics platform capability that provides security teams with real-time querying, interactive dashboards, and AI-powered investigation assistance through Scout AI Assistant for plain-language querying and automated executive reporting.
- OnWatch
Products and services
- ZeroFox Platform
- Cyber Threat Intelligence
- Attack Surface Intelligence
- Brand + Domain Protection
- Executive + VIP Protection
- Physical Security Intelligence
- ZeroFox AI Analytics
Quantifiable outcome
- 287% ROI according to Forrester Consulting Total Economic Impact study
- +4 more outcomes
Companies that use ZeroFox
Customer profileNamed customers7 records
Segments9 records
Ideal customer profiles3 records
ZeroFox technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration11 records
AI capability12 records
Feature6 records
ZeroFox partnerships and signals
Strategic signalPartnerships
Four partnerships are on record, tiered core and flagship.
- Reality DefendercoreZeroFox partnered with Reality Defender to integrate AI-generated media detection into ZeroFox's Discover, Validate, Disrupt workflow. The partnership enables security teams to identify synthetic media (deepfakes) before it circulates through multimodal detection for voice, video, and image content. The integration addresses the growing threat of deepfakes combined with social engineering attacks.
- e92pluscoreZeroFox expanded its partnership with e92plus to bring external threat protection MSSP program to e92plus's partner network across UK, Ireland, and Benelux. The partnership gives MSSPs access to brand protection, phishing disruption, dark web monitoring, impersonation detection, and executive protection capabilities through over 700 pre-built connectors.
- Google (Web Risk)flagshipZeroFox is a Google Web Risk Founding Partner, enabling the company to block malicious URLs across 5B+ devices in as little as 15 minutes. This strategic partnership provides unmatched scale for takedown operations and threat disruption capabilities.
- Amazon Web Services (AWS)coreZeroFox uses AWS cloud services for infrastructure of its cloud-hosted Services. AWS is listed as an Ordinary Course Provider in customer agreements, indicating a strategic technology infrastructure partnership.
Scale indicators9 records
Recent moves7 records
Expansion highlights6 records
ZeroFox competitors and assessment
Company assessmentDirect peers
- Recorded Future: Recorded Future is a direct competitor in external threat intelligence and digital risk protection, offering a threat intelligence platform that aggregates data from the dark web, open web, and technical sources. Gartner places both companies in the Leaders quadrant for Cyberthreat Intelligence Technologies.
- Group-IB: Group-IB provides external threat intelligence, fraud prevention, and digital risk protection services with similar coverage of dark web, brand abuse, and adversary tracking. Gartner lists it alongside ZeroFox as a Leader in the Cyberthreat Intelligence Technologies Magic Quadrant.
- ReliaQuest (Digital Shadows): ReliaQuest acquired Digital Shadows, a direct competitor in digital risk protection and external threat intelligence. Digital Shadows' SearchLight service overlaps closely with ZeroFox's brand protection, impersonation detection, and external attack surface monitoring.
- BrandShield: BrandShield is a direct competitor focused on digital risk protection, brand protection, and anti-phishing for enterprise customers. It competes head-to-head with ZeroFox's Brand + Domain Protection and Executive + VIP Protection modules.
- CyberInt: CyberInt provides external threat intelligence, digital risk protection, and threat intelligence-led managed services. It competes directly with ZeroFox's MSSP-friendly offerings and external threat intelligence capabilities.
- LookingGlass Cyber Solutions: LookingGlass Cyber Solutions was acquired by ZeroFox in 2023 for approximately $25.5-26 million. It remains a peer-comparable in attack surface management and threat intelligence, representing integrated capability within ZeroFox rather than a standalone competitor.
Broad incumbents
- CrowdStrike: CrowdStrike is a broader cybersecurity incumbent whose Falcon Intelligence and Charlotte AI offerings overlap with ZeroFox's external threat intelligence capabilities. CrowdStrike's much larger scale and endpoint security footprint make it a key competitive threat as it bundles threat intel into its XDR platform.
- Mandiant (Google Cloud): Mandiant, now part of Google Cloud, is a leader in threat intelligence and incident response. Its intelligence capabilities and Google-backed scale create overlapping competition with ZeroFox's Cyber Threat Intelligence and breach response offerings.
- RiskIQ (Microsoft): RiskIQ, now part of Microsoft, provides external attack surface management and digital risk protection. Its integration into Microsoft's broader security stack and Defender ecosystem makes it a significant competitor to ZeroFox's Attack Surface Intelligence module.
- Proofpoint: Proofpoint is a larger cybersecurity incumbent with adjacent brand protection, impersonation defense, and digital risk capabilities. Its broader enterprise security portfolio and large installed base create competitive overlap with ZeroFox's brand and executive protection offerings.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
ZeroFox social profiles
Digital presenceZeroFox compliance and trust
Trust signalCompliance4 records
ZeroFox financial estimates
Financial estimateRevenue estimate
Valuation estimate
ZeroFox leadership team
Management profileNumber of profiles
Profiles10 records
ZeroFox funding detail
Funding detailFunding overview
Funding rounds6 records
Investors20 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
ZeroFox M&A and investment
M&A and investmentM&A4 records
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about ZeroFox
What does ZeroFox do?
ZeroFox operates a cloud-based SaaS external cybersecurity platform that fuses AI, machine learning, and human analyst expertise to identify, validate, and disrupt external threats across social media, the deep and dark web, domains, app stores, and physical locations. Its continuous Discover-Validate-Disrupt cycle enables enterprise customers to discover digital exposure, validate threats through human-in-the-loop analysis, and disrupt adversaries via automated takedowns backed by the Global Disruption Network. Revenue is generated through annual platform subscriptions and separately sold professional services including implementation, training, on-demand investigations, and managed security.
Is ZeroFox a public or private company?
ZeroFox is a private company. It is classified as private equity controlled and is currently operating.
When was ZeroFox founded?
ZeroFox was founded in 2013. It employs 501 to 1,000 people.
Where is ZeroFox based?
ZeroFox is headquartered in Baltimore, United States, in the North America region.
How does ZeroFox make money?
Two revenue lines are on record. Platform Subscriptions are the primary driver. The others are professional Services.
Who are ZeroFox's main competitors?
Direct peers on record are Recorded Future, Group-IB, ReliaQuest (Digital Shadows), BrandShield, CyberInt and LookingGlass Cyber Solutions. Broad incumbents are CrowdStrike, Mandiant (Google Cloud), RiskIQ (Microsoft) and Proofpoint.
Does ZeroFox have an API?
No public API is recorded for ZeroFox.
What industry is ZeroFox in?
ZeroFox's product category is External Cybersecurity. Its primary akta.pro industry code is HDADALAI, Marketplace & Platform Trust & Safety (Buyer/Seller Abuse), with a secondary code of HDADALAG, Spam, Fake Engagement & Content Abuse Prevention. Its NAICS code is 5132 and its SIC code is 7372.