- Attack
- Cybersecurity
- Cyber Threat Intelligence
- Enterprise
- Incident Response
- Monitoring
- Open Source
- Open-Source Intelligence
Show all 17 topics
2 ZeroFox appears across 2 articles in the last 90 days, most recently in ZeroFox launches HNTR and HNTR Executive Protection (Jul 2026).
Who is ZeroFox?
ZeroFox is a cybersecurity company that provides a platform for external attack surface management and protection across public, social, and digital channels for enterprises and public sector organizations.
- External cybersecurity platform focused on threats across social media, public web, domains, and digital channels (external threat protection).
- Digital risk protection services for phishing, impersonation, brand misuse, and account takeover (digital risk protection).
- Threat intelligence services aggregating open-source, deep, and dark web data to support Security Operations (SecOps) (threat intelligence).
- Exposure and attack surface management capabilities to identify and monitor internet-facing assets (attack surface management).
- Takedown and disruption services for malicious or fraudulent content, domains, and accounts in coordination with platforms and providers (threat disruption).
Show more
More About ZeroFox
ZeroFox focuses on external cybersecurity, with offerings designed to identify, monitor, and mitigate threats that originate outside an organization’s internal network, including social media platforms, public websites, domains, and other digital channels. Its platform is typically integrated into enterprise security programs as a complement to internal network and endpoint security tools, extending security teams’ visibility to public and third-party environments where brand, employee, and customer data may be misused.
The company’s digital risk protection (digital risk protection) capabilities address scenarios such as phishing campaigns, domain spoofing, executive and employee impersonation, account takeover, fraudulent profiles, and brand misuse. These services often feed alerts and context into SecOps center (SOC) workflows, Security Information and Event Management (SIEM) platforms (security information and event management), and ticketing systems, enabling incident response teams to triage and remediate external threats alongside internal security events.
ZeroFox threat intelligence (threat intelligence) aggregates data from Open-Source Intelligence (OSINT), surface web, and dark web sources to provide context on threat actors, campaigns, and exposed data. This intelligence is commonly used by Cyber Threat Intelligence (CTI) teams, fraud teams, and incident responders to inform risk assessments, prioritize mitigation, and support investigations. The platform typically supports structured feeds, dashboards, and API-based integrations so that intelligence can be consumed by existing enterprise security tooling.
In attack surface management (attack surface management), ZeroFox focuses on discovering and monitoring internet-exposed assets associated with an organization, such as domains, subdomains, and other publicly accessible services. By mapping these assets and flagging exposure or misconfigurations, the platform can assist organizations in reducing the attack surface that can be exploited from outside the corporate perimeter.
ZeroFox also provides takedown and threat disruption services (threat disruption), coordinating with domain registrars, hosting providers, and social or digital platforms to request removal or disablement of malicious domains, fraudulent accounts, and harmful content. This service line integrates with detection capabilities so that once phishing pages, impersonation profiles, or brand abuse are identified, ZeroFox can support or manage the process of containment and removal.
From a technical architecture perspective, ZeroFox is commonly positioned as a cloud-based Software-as-a-Service (SaaS) platform (security SaaS) that ingests large volumes of external digital data, applies analytics and classification, and then exposes results through web consoles, alerting, and APIs. It is typically categorized in enterprise security portfolios under external attack surface management, digital risk protection, and CTI, and is used by security, fraud, and brand protection teams that require monitoring and response capabilities outside traditional network and endpoint boundaries.
Our description of ZeroFox. Updated December 2025.
