ZeroFox

What ZeroFox does

ZeroFox is an external cybersecurity company founded in 2013 and headquartered in Baltimore, Maryland, that provides digital risk protection through a unified SaaS platform. The platform executes a continuous Discover-Validate-Disrupt cycle across social media, the deep and dark web, domains, app stores, and infrastructure, ingesting 12B+ signals into a data graph and combining large-scale automation with human analyst expertise to identify, validate, and actively disrupt external threats. Core product modules include Cyber Threat Intelligence (with sub-products spanning Dark Web Intelligence, Detections & Investigation, Breach and Extortion Response, Compromised Credentials, Intel Feeds/Briefs, and Intel Search Portal), Attack Surface Intelligence, Brand + Domain Protection, Executive + VIP Protection, and Physical Security Intelligence, augmented by the OnWatch 24x7 managed service and the recently launched ZeroFox AI Analytics capability with Scout AI Assistant.

The company's technology stack integrates AI across multiple modalities — NLP for dark web analysis, computer vision for deepfake detection (via the Reality Defender partnership), anomaly detection for phishing and impersonation, and generative AI for natural-language querying — protected by a portfolio of 19+ granted US patents. A founding partnership with Google Web Risk enables blocking of malicious URLs across 5B+ devices within 15 minutes, supporting the Global Disruption Network's takedown operations with a claimed 99%+ success rate. The platform integrates with 700+ connectors spanning TIP, SIEM, SOAR, and EDR systems, plus direct integrations with social platforms including Facebook, Instagram, LinkedIn, X, YouTube, and Zoom.

ZeroFox generates revenue primarily through 1- to 3-year subscription contracts with pricing tied to the number of protected brands, social media accounts, domains, and takedown request volumes, supplemented by professional services revenue from implementation, configuration, training, managed security, breach response, and incident response engagements. Go-to-market combines direct enterprise field sales with channel distribution through authorized resellers and MSSP partners (notably e92plus in the UK, Ireland, and Benelux). The company serves thousands of organizations across Financial Services, Media and Entertainment, Retail and CPG, Healthcare, Public Sector, Technology, and Legal verticals, with operations in the United States, United Kingdom, India, and Chile. ZeroFox was publicly traded on NASDAQ (ZFOX) before being taken private through a buyout by Haveli Investments in 2025.

Name

ZeroFox

Legal name

ZeroFox, Inc.

Website

https://zerofox.com

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

501–1,000 employees

Short description

ZeroFox provides external cybersecurity SaaS that discovers, validates, and disrupts digital threats across social media, dark web, domains, and infrastructure for enterprise and government customers globally.

Ownership category

akta.pro rank

Product category

External Cybersecurity

NAICS

Software Publishers (5132), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Marketplace & Platform Trust & Safety (Buyer/Seller Abuse) (HDADALAI)

akta.pro secondary industry

Spam, Fake Engagement & Content Abuse Prevention (HDADALAG)

Keywords

• External cybersecurity platform
• Digital risk protection
• Threat intelligence services
• Brand protection software
• Attack surface management

Headquarters

HQ city

Baltimore

HQ country

United States

HQ region

North America

Offices4 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Platform Subscriptions: ZeroFox generates revenue primarily through subscription-based platform access. Customers purchase Platform Subscriptions that grant access to the SaaS security platform during a defined subscription term (1, 2, or 3 years). Pricing is based on service parameters including number of business brands, social media accounts, domains eligible for protection, supported source platforms, and number of takedown requests.
2. Professional Services: Additional revenue from professional services including implementation, configuration, training, on-demand investigations, managed security, takedown services, breach-response services, incident response services, and other security advisory or consulting. These are sold separately or on a stand-alone basis through statements of work.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels6 records

Core offering

ZeroFox operates a cloud-based SaaS external cybersecurity platform that fuses AI, machine learning, and human analyst expertise to identify, validate, and disrupt external threats across social media, the deep and dark web, domains, app stores, and physical locations. Its continuous Discover-Validate-Disrupt cycle enables enterprise customers to discover digital exposure, validate threats through human-in-the-loop analysis, and disrupt adversaries via automated takedowns backed by the Global Disruption Network. Revenue is generated through annual platform subscriptions and separately sold professional services including implementation, training, on-demand investigations, and managed security.

Product overview

ZeroFox offers a unified external cybersecurity platform organized around a continuous Discover-Validate-Disrupt cycle. The core platform is complemented by five integrated product modules: Cyber Threat Intelligence (encompassing Dark Web Intelligence, Detections & Investigation, Breach and Extortion Response, Compromised Credentials, Intel Feeds and Briefs, and Intel Search Portal), Attack Surface Intelligence, Brand + Domain Protection, Executive + VIP Protection, and Physical Security Intelligence. Additional capabilities include ZeroFox AI Analytics with Scout AI Assistant for natural language querying, the Malware + URL Sandbox for threat analysis, and the OnWatch 24x7 managed service. The platform integrates with TIP, SIEM, SOAR, and EDR solutions, and partnerships like Reality Defender add deepfake detection capabilities.

Differentiator

Problem solved

Functional benefit

Brands

• ZeroFox AI Analytics: AI-powered analytics platform capability that provides security teams with real-time querying, interactive dashboards, and AI-powered investigation assistance through Scout AI Assistant for plain-language querying and automated executive reporting.
• OnWatch

Products and services

• ZeroFox Platform
• Cyber Threat Intelligence
• Attack Surface Intelligence
• Brand + Domain Protection
• Executive + VIP Protection
• Physical Security Intelligence
• ZeroFox AI Analytics

Quantifiable outcome

• 287% ROI according to Forrester Consulting Total Economic Impact study
• +4 more outcomes

Named customers7 records

Segments9 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration11 records

AI capability12 records

Feature6 records

Partnerships

Four partnerships are on record, tiered core and flagship.

• Reality DefendercoreTechnology or Integration · 2 June 2026ZeroFox partnered with Reality Defender to integrate AI-generated media detection into ZeroFox's Discover, Validate, Disrupt workflow. The partnership enables security teams to identify synthetic media (deepfakes) before it circulates through multimodal detection for voice, video, and image content. The integration addresses the growing threat of deepfakes combined with social engineering attacks.
• e92pluscoreChannel Partner/ Reseller/ Distributor · 4 May 2026ZeroFox expanded its partnership with e92plus to bring external threat protection MSSP program to e92plus's partner network across UK, Ireland, and Benelux. The partnership gives MSSPs access to brand protection, phishing disruption, dark web monitoring, impersonation detection, and executive protection capabilities through over 700 pre-built connectors.
• Google (Web Risk)flagshipStrategic or Co-development PartnerZeroFox is a Google Web Risk Founding Partner, enabling the company to block malicious URLs across 5B+ devices in as little as 15 minutes. This strategic partnership provides unmatched scale for takedown operations and threat disruption capabilities.
• Amazon Web Services (AWS)coreTechnology or IntegrationZeroFox uses AWS cloud services for infrastructure of its cloud-hosted Services. AWS is listed as an Ordinary Course Provider in customer agreements, indicating a strategic technology infrastructure partnership.

Scale indicators9 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• Recorded Future: Recorded Future is a direct competitor in external threat intelligence and digital risk protection, offering a threat intelligence platform that aggregates data from the dark web, open web, and technical sources. Gartner places both companies in the Leaders quadrant for Cyberthreat Intelligence Technologies.
• Group-IB: Group-IB provides external threat intelligence, fraud prevention, and digital risk protection services with similar coverage of dark web, brand abuse, and adversary tracking. Gartner lists it alongside ZeroFox as a Leader in the Cyberthreat Intelligence Technologies Magic Quadrant.
• ReliaQuest (Digital Shadows): ReliaQuest acquired Digital Shadows, a direct competitor in digital risk protection and external threat intelligence. Digital Shadows' SearchLight service overlaps closely with ZeroFox's brand protection, impersonation detection, and external attack surface monitoring.
• BrandShield: BrandShield is a direct competitor focused on digital risk protection, brand protection, and anti-phishing for enterprise customers. It competes head-to-head with ZeroFox's Brand + Domain Protection and Executive + VIP Protection modules.
• CyberInt: CyberInt provides external threat intelligence, digital risk protection, and threat intelligence-led managed services. It competes directly with ZeroFox's MSSP-friendly offerings and external threat intelligence capabilities.
• LookingGlass Cyber Solutions: LookingGlass Cyber Solutions was acquired by ZeroFox in 2023 for approximately $25.5-26 million. It remains a peer-comparable in attack surface management and threat intelligence, representing integrated capability within ZeroFox rather than a standalone competitor.

Broad incumbents

• CrowdStrike: CrowdStrike is a broader cybersecurity incumbent whose Falcon Intelligence and Charlotte AI offerings overlap with ZeroFox's external threat intelligence capabilities. CrowdStrike's much larger scale and endpoint security footprint make it a key competitive threat as it bundles threat intel into its XDR platform.
• Mandiant (Google Cloud): Mandiant, now part of Google Cloud, is a leader in threat intelligence and incident response. Its intelligence capabilities and Google-backed scale create overlapping competition with ZeroFox's Cyber Threat Intelligence and breach response offerings.
• RiskIQ (Microsoft): RiskIQ, now part of Microsoft, provides external attack surface management and digital risk protection. Its integration into Microsoft's broader security stack and Defender ecosystem makes it a significant competitor to ZeroFox's Attack Surface Intelligence module.
• Proofpoint: Proofpoint is a larger cybersecurity incumbent with adjacent brand protection, impersonation defense, and digital risk capabilities. Its broader enterprise security portfolio and large installed base create competitive overlap with ZeroFox's brand and executive protection offerings.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/ZeroFox
• Facebookfacebook.com/GetZeroFOX
• LinkedInlinkedin.com/company/zerofox
• Instagraminstagram.com/zerofox

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds6 records

Investors20 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A4 records

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ZeroFox