ZeroFox protects organisations from threats that start outside their own network: impersonation of their brand and executives, phishing domains, leaked employee and customer credentials, dark web chatter and physical risks to leaders. It finds those threats, confirms which ones matter and then removes them, combining its own intelligence collection with analysts and a takedown network.
Its HNTR Platform brings these functions together for security, brand and executive protection teams.
At A Glance
| Vendor | ZeroFox |
|---|---|
| Category | Threat intelligence, security operations |
| Platform | HNTR Platform |
| Identities covered | Employee, customer, executive and supplier credentials; executives and brands targeted by impersonation |
| AI features | Risk scoring, natural language search, deepfake and impersonation detection |
| Certifications | SOC 2 Type II, UK Cyber Essentials, EU-U.S. Data Privacy Framework |
| Founded | 2013, Baltimore, Maryland |
| Market classification | Threat Intelligence; also Security Operations |
What ZeroFox Does
Most security tools watch the inside of the network. Attackers increasingly work outside it, setting up lookalike domains, fake social accounts and marketplace listings, and trading stolen credentials. ZeroFox covers that external ground in a continuous cycle of discovering threats, validating them and disrupting them, so customers receive confirmed, enriched alerts rather than raw noise and do not have to chase takedowns themselves. AI speeds up the work, and human experts apply the judgement.
The platform draws on a data graph of more than 12 billion signals.
Products
Cyber Threat Intelligence
For security operations and intelligence teams, this covers dark web monitoring, detections and investigations, and breach and extortion response. Compromised credential monitoring watches stealer logs, dark web markets and criminal forums for the organisation’s credentials. Intel feeds, briefs and a search portal support analysts’ own research.
Attack Surface Intelligence
Attack surface intelligence helps teams find what they expose to the internet before attackers do. It discovers assets, validates exposures, prioritises fixes and feeds them into workflows, and it extends the view to third parties and suppliers and to cloud and SaaS posture.
Brand And Domain Protection
Marketing, legal and security teams use this to stop others trading on their name. It watches for fraudulent domains, fake social media accounts and counterfeit marketplace and app store listings, then enforces takedowns.
Executive And VIP Protection
Executive protection shields leaders from impersonation, doxxing and physical threats. It removes personal information from Google results, data brokers and searchable databases, watches dark web forums for exposed home addresses, family details and leaked executive credentials, and sends real-time alerts about severe weather, civil unrest or active shooter situations near an executive.
How It Works
ZeroFox runs as a platform backed by analyst services, not as software installed in the customer’s environment. Intelligence collection gathers signals from the surface, deep and dark web; AI and analysts validate and enrich them, with malware and URL sandboxing available for analysis; and the Global Disruption Network works with ISPs, registrars, hosts and platforms to take threats down. Alerts and indicators then flow into the customer’s own tools through APIs and webhooks.
For compromised credentials, connecting ZeroFox to identity management systems lets password resets and access revocations happen automatically once a leak is confirmed.
Identities And Systems Covered
| Employee credentials | Detected in fresh stealer logs or dark web marketplaces |
|---|---|
| Customer credentials | A common monitoring use for consumer-facing organisations |
| Executive credentials | Flagged in breach dumps or threat actor discussions |
| Supplier credentials | Supply chain leaks that can signal lateral movement |
| Executives and brands | Impersonation, fake accounts and doxxing across social media and the web |
| Identity systems | Microsoft Entra ID and Axonius, used to act on credential exposures |
Agentic AI Capabilities
The HNTR Platform uses AI across detection, prioritisation and search.
| Detection | Smart Pattern Detection spots deepfakes, impersonations and coordinated attacks across text, images and video. Video Analysis catches deepfakes and audio-based abuse, and Image Recognition finds stolen brand marks and visual impersonation. |
|---|---|
| Prioritisation and remediation | AI Risk Scoring puts the most critical threats first to cut noise. Attack Surface Remediation gives step-by-step guidance on fixes and automates ticketing, and Unified Threat Context links signals from different channels into clear risk priorities. |
| Search and analysis | Natural Language Search lets analysts ask questions conversationally to uncover trends and relationships, supported by relationship mapping and sentiment analysis. |
Integrations
| Area | Integrations |
|---|---|
| SIEM | ArcSight, Arctic Wolf, Exabeam, Fortinet, IBM QRadar, LogRhythm, Microsoft Sentinel, Sumo Logic, Google SecOps |
| SOAR | Cortex XSOAR, Cyware, Swimlane, Tines, Torq |
| Threat intelligence | Anomali, MISP, OpenCTI, ThreatConnect, ThreatQuotient |
| ITSM | FreshService, Jira, ManageEngine, ServiceNow, TheHive, Zendesk |
| Collaboration and BI | Microsoft Teams, Slack, Power BI, Tableau |
| Other | Rapid7, Cisco Umbrella, Securonix, Splunk |
Company Background
| Founded | 2013, by James C. Foster and Evan L. Blair |
|---|---|
| Headquarters | Baltimore, Maryland, United States |
| Ownership | Acquired in May 2024 by Haveli Investments, a technology-focused private equity firm, for $1.14 per share in cash |
| Scale | A reported thousands of organisations worldwide |
Note: This overview is compiled from ZeroFox’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.