ZeroFox
ZeroFox is a United States cybersecurity company focused on detecting and disrupting external digital and physical threats to organizations, brands, people, and assets.
Last updated October 30, 2026
AI crawler reads
2requests
1companies- Anthropic2
- Profile
- 1
- Controversies
- 1
- JSON · MD
- 0
- First read
- Nov 4, 2026
- Latest read
- Nov 4, 2026
Since Oct 28, 2026 · from this site's server log
Overview
ZeroFox is an American external cybersecurity company headquartered in Baltimore, Maryland. Its business is centered on identifying threats that originate outside an organization’s conventional security perimeter, including phishing and fraud campaigns, impersonation, credential theft, exposed data, botnet activity, malicious domains, dark-web activity, and selected physical threats. The company delivers much of this capability through cloud-based software-as-a-service products designed to help organizations discover, investigate, prioritize, and disrupt threats directed at their brands, domains, employees, customers, executives, and other assets. The company was created in 2013 under the name Riskive and adopted the ZeroFox name several months later. It began operations in Betamore, a Baltimore startup incubator, where it occupied an approximately 8,000-square-foot space. As the business expanded, it moved in 2016 to an approximately 18,000-square-foot facility in a former Pabst Brewing site in South Baltimore. Early financing supported the development of its external threat-detection and digital-risk capabilities. ZeroFox raised $27 million in a Series B financing in 2015. A further 2017 financing led by Redline Capital Management and Silver Lake Waterman brought total reported funding to $88 million, with participation from earlier investors including New Enterprise Associates, Highland Capital Partners, and Core Capital. In 2020, Intel Capital led a further $74 million financing round, bringing reported cumulative backing to $162 million. ZeroFox expanded its platform through technology partnerships and acquisitions. Its partnerships have included IBM, Hootsuite, Splunk, ThreatQuotient, and Google Cloud. These relationships supported integrations for security operations, threat visualization, social-media monitoring, incident analysis, and phishing-domain warnings. The company acquired Cyveillance from LookingGlass in 2020 to add threat-intelligence and dark-web data capabilities, followed by the 2021 acquisition of dark-web intelligence company Vigilante. In 2022, ZeroFox acquired breach-response provider ID Experts Holdings (commonly known as IDX) as part of its public-market transaction. It acquired LookingGlass Cyber Solutions in 2023, adding external attack-surface management and threat-intelligence capabilities. ZeroFox became a public company on August 4, 2022, through a business combination with a special-purpose acquisition company. According to the cited reference material, the transaction valued the combined enterprise at approximately $1.4 billion and resulted in the company name ZeroFox Holdings, Inc. Its common stock traded on Nasdaq under ZFOX and warrants under ZFOXW. The public-company period ended after ZeroFox agreed in February 2024 to be acquired by Haveli Investments in an all-cash deal with an announced enterprise value of approximately $350 million. Haveli completed the acquisition on May 13, 2024, taking the company private. In November 2024, ZeroFox divested its IDX subsidiary to Kingswood Capital Management. ZeroFox’s history also includes public criticism over its handling of social-media intelligence. During Baltimore protests following Freddie Gray’s death in 2015, the company classified nonviolent protest organizers DeRay McKesson and Johnetta Elzie as high physical threats to law enforcement. Critics argued that the system failed to distinguish impersonating or troll accounts from Elzie’s genuine social-media presence and wrongly characterized people who were not accused of crimes. The company also supplied social-media intelligence to the FBI under a reported $14 million contract beginning December 30, 2020. Reporting on the transition from Dataminr linked the change to reduced visibility before the January 6, 2021 attack on the U.S. Capitol, prompting further scrutiny of the contract and its operational effectiveness.
History
ZeroFox originated in Baltimore in 2013 under the name Riskive. The startup changed its name to ZeroFox within months and began operating from Betamore, a startup incubator in the Federal Hill neighborhood. Its early business developed around the idea that organizations needed visibility beyond their managed networks: attackers could exploit public websites, social-media accounts, domains, criminal forums, exposed credentials, and other external assets even when internal security controls were functioning. The company expanded its Baltimore footprint as it grew. In 2016, it left its approximately 8,000-square-foot incubator space for an approximately 18,000-square-foot location in a former Pabst Brewing facility in South Baltimore. Financing supported this expansion and the development of its cloud-based software. ZeroFox raised $27 million in Series B funding in 2015. In 2017, Redline Capital Management and Silver Lake Waterman led another financing, joined by New Enterprise Associates, Highland Capital Partners, and Core Capital. The cited account reported that the round brought cumulative funding to $88 million. Intel Capital led a further approximately $74 million round in 2020, bringing reported cumulative backing to $162 million. ZeroFox built its platform through integrations with established technology providers. Its cited partners included IBM, Hootsuite, Splunk, and ThreatQuotient, while its relationship with Google Cloud supported warnings about phishing domains. These partnerships reflected the company’s effort to make external threat intelligence useful inside security operations, collaboration, analytics, and incident-response workflows. Acquisitions became a major part of the company’s expansion. In October 2020, ZeroFox acquired Cyveillance from LookingGlass. The transaction was intended to combine Cyveillance’s threat-intelligence collection and dark-web capabilities with the ZeroFox Digital Risk Protection Platform. In July 2021, ZeroFox acquired Vigilante, another dark-web threat-intelligence business. In August 2022, it acquired ID Experts Holdings, adding breach-response capabilities. In April 2023, it acquired LookingGlass Cyber Solutions, broadening its external attack-surface management and threat-intelligence portfolio. ZeroFox entered the public markets on August 4, 2022, through a business combination with a special-purpose acquisition company. The transaction was described in the cited material as a $1.4 billion deal. The resulting public company was named ZeroFox Holdings, Inc., with common stock trading on Nasdaq under ZFOX and warrants under ZFOXW. The public-company period was relatively short. On February 6, 2024, ZeroFox announced a definitive agreement for Haveli Investments to acquire it in an all-cash transaction with an announced enterprise value of approximately $350 million. Haveli completed the purchase on May 13, 2024, taking ZeroFox private. In November 2024, the company divested its IDX subsidiary to Kingswood Capital Management. The company has also faced criticism over the use of its intelligence products. During Baltimore’s 2015 protests following Freddie Gray’s death, ZeroFox classified nonviolent organizers DeRay McKesson and Johnetta Elzie as high physical threats to law enforcement. Critics said the system did not adequately separate impersonating troll accounts from Elzie’s genuine social-media presence and treated organizers as threats despite the absence of allegations that they had committed crimes. Separately, ZeroFox assumed a reported $14 million FBI social-media intelligence contract from Dataminr on December 30, 2020. The handover and its effect on intelligence visibility before the January 6, 2021 Capitol attack became a subject of public scrutiny. These episodes illustrate both the company’s role in high-stakes external intelligence and the risks associated with automated threat classification.
- 2024
Taken private by Haveli Investments
[1]Haveli Investments completed its acquisition of ZeroFox Holdings on May 13, 2024.
- 2024
IDX divested
[1]ZeroFox divested its IDX subsidiary to Kingswood Capital Management in November 2024.
- 2023
Acquisition of LookingGlass Cyber Solutions
[1]ZeroFox acquired LookingGlass Cyber Solutions to add external attack-surface management and threat intelligence.
- 2022
Public listing and acquisition of IDX
[1]ZeroFox completed its SPAC transaction, became publicly traded as ZFOX, and acquired ID Experts Holdings.
- 2021
Acquisition of Vigilante
[1]ZeroFox acquired dark-web threat-intelligence company Vigilante.
- 2020
Intel Capital leads new financing
[1]ZeroFox closed a reported $74 million financing round led by Intel Capital, bringing reported total backing to $162 million.
- 2020
Acquisition of Cyveillance
[1]ZeroFox acquired Cyveillance from LookingGlass to strengthen threat intelligence and dark-web monitoring.
- 2017
Funding reaches a reported $88 million
[1]A financing led by Redline Capital Management and Silver Lake Waterman, with participation from earlier investors, brought reported cumulative funding to $88 million.
- 2016
Moves to a larger Baltimore facility
[1]The company moved from its Betamore incubator space into a larger former Pabst Brewing facility in South Baltimore.
- 2015
Series B financing
[1]ZeroFox raised a reported $27 million in Series B funding.
Products and positioning
ZeroFox positions itself as an external cybersecurity and digital-risk protection provider. Rather than focusing only on internal networks and endpoints, its offering emphasizes discovering and disrupting threats across the open web, social platforms, criminal marketplaces, the dark web, domains, exposed infrastructure, and other external channels.
Digital risk protection
ZeroFox Digital Risk Protection Platform
The Digital Risk Protection Platform is the company’s central cloud-based offering for monitoring and responding to threats outside an organization’s traditional security boundary. Its scope includes brand impersonation, phishing, fraudulent domains, exposed credentials, data leaks, malicious social-media activity, botnet exposure, and other external risks. The platform is intended to help security teams identify assets and threats, connect related intelligence, prioritize incidents, and support disruption or takedown actions.
Attack-surface management
External attack-surface management
ZeroFox’s external attack-surface capabilities focus on discovering and assessing internet-facing assets associated with an organization. The approach is designed to reveal domains, infrastructure, services, and other externally visible resources that may be unknown, misconfigured, impersonated, or exposed to attack. This capability was strengthened through the 2023 acquisition of LookingGlass Cyber Solutions.
Threat intelligence
Threat intelligence and dark-web monitoring
ZeroFox provides intelligence on threats appearing across criminal forums, dark-web marketplaces, social platforms, and other external sources. The company expanded this area through its acquisitions of Cyveillance in 2020 and Vigilante in 2021. The resulting data and analysis are intended to identify stolen credentials, planned attacks, exposed information, malicious actors, and indicators that can be used by security and response teams.
Breach response · 2022
Breach response and identity protection
ZeroFox added breach-response capabilities through its acquisition of ID Experts Holdings, associated with the IDX business, in 2022. These capabilities complemented the company’s external threat monitoring by addressing response and identity-protection needs after data compromise. ZeroFox later divested IDX to Kingswood Capital Management in November 2024, so this offering is no longer part of the company’s retained portfolio.
Controversies
2021
Scrutiny of FBI intelligence transition before the Capitol attack
ZeroFox’s assumption of the FBI’s social-media intelligence contract from Dataminr on December 30, 2020, was later associated with reported reductions in visibility before the January 6, 2021 attack on the United States Capitol. The transition and the contract’s operational performance became subjects of public criticism and scrutiny.
2015
Criticism over surveillance of Freddie Gray protest organizers
ZeroFox was criticized for classifying nonviolent Baltimore protest organizers DeRay McKesson and Johnetta Elzie as high physical threats to law enforcement during demonstrations following Freddie Gray’s death. Critics also said the company’s system failed to distinguish impersonating troll accounts from Elzie’s authentic social-media activity. The episode raised concerns about automated threat labeling, protest monitoring, and the treatment of people who were not suspected of criminal conduct.
Brand decisions
2024
Agree to sale to Haveli InvestmentsM&ABackground
After a period as a Nasdaq-listed company, ZeroFox agreed to a private-equity acquisition.
Action taken
ZeroFox announced an all-cash agreement under which Haveli Investments would acquire the company.
Aftermath
Haveli completed the acquisition on May 13, 2024, taking ZeroFox private.
Announced enterprise value. Approximately $350 million (Agreement announced February 6, 2024; completed May 13, 2024)
2024
Divest IDXM&ABackground
Following the change in ownership, ZeroFox separated its breach-response and identity-protection subsidiary from the retained external cybersecurity business.
Action taken
ZeroFox sold or divested IDX to Kingswood Capital Management in November 2024.
Aftermath
IDX ceased to be part of ZeroFox’s retained operating portfolio.
2023
Acquire LookingGlass Cyber SolutionsM&ABackground
ZeroFox aimed to strengthen the external asset-discovery and attack-surface side of its cybersecurity platform.
Action taken
It acquired LookingGlass Cyber Solutions, an external attack-surface management and threat-intelligence company.
Aftermath
The acquisition expanded ZeroFox’s capabilities for discovering and analyzing internet-facing assets and external threats.
2022
Complete SPAC transaction and acquire IDXM&ABackground
ZeroFox pursued a public-market transaction while broadening its cybersecurity services into breach response.
Action taken
The company completed its SPAC combination on August 4, 2022, and acquired ID Experts Holdings as part of the transaction.
Aftermath
The combined business became ZeroFox Holdings, Inc. and traded on Nasdaq under ZFOX, with warrants under ZFOXW.
Announced transaction value. $1.4 billion (August 4, 2022)
2021
Acquire VigilanteM&ABackground
The company was expanding its ability to monitor threats in dark-web environments.
Action taken
ZeroFox acquired Vigilante, a dark-web threat-intelligence company.
Aftermath
The transaction added further dark-web intelligence capabilities to ZeroFox’s portfolio.
2020
Acquire CyveillanceM&ABackground
ZeroFox sought to deepen its external threat-intelligence and dark-web monitoring capabilities.
Action taken
It acquired Cyveillance from LookingGlass and integrated its intelligence resources with the ZeroFox Digital Risk Protection Platform.
Aftermath
The acquisition broadened the data and monitoring base supporting ZeroFox’s external-risk products.
Recent events
ZeroFox announces SPAC merger with L&F Acquisition[2]
Reported:
ZeroFox announced plans to go public through a merger with special-purpose acquisition company L&F Acquisition Corp. The transaction values ZeroFox at $1.4 billion; the combined company is to be named ZeroFox Holdings Inc. when the deal is complete.
ZeroFox announces acquisition of IDX[2]
Reported:
ZeroFox announced that it was acquiring Identity Theft Guard Solutions, known as IDX. ZeroFox said the acquisition would add external threat protection capabilities and breach response services.
- Unconfirmed
ZeroFox wins CISO Choice Award for threat intelligence[3]
ZeroFox announced that it won the Threat Intelligence category in the 2021 CISO Choice Awards.
ZeroFox and Mandiant announce global strategic partnership[4]
Reported:
ZeroFox announced a global strategic partnership with Mandiant, under which ZeroFox will be offered as part of the Mandiant Advantage SaaS platform.
ZeroFOX acquires Vigilante[5]
Reported:
ZeroFOX said it had acquired Vigilante ATI, a dark-web intelligence research firm, for an undisclosed sum.
ZeroFOX announces acquisition of Cyveillance business[6]
Reported:
ZeroFOX announced that it had acquired the Cyveillance business from LookingGlass Cyber Solutions, Inc., combining Cyveillance's threat intelligence capabilities with the ZeroFOX platform.
Sources6 sources
Cite this profile: Cite the canonical profile. /brand-wiki/zerofox · Editorial policy · How profiles are compiled