ZeroFox
External cybersecurity: threat intel, brand, domain and executive protection
Own ZeroFox? Claim it, free to correct the facts and get the verified badge.
Pricing
Contact for pricing
API
Yes
Company
ZeroFox
Platforms
What is ZeroFox?
ZeroFox is an external cybersecurity platform that finds, validates and takes down threats outside a company's firewall. These include brand impersonation, lookalike domains, phishing, executive doxxing, leaked credentials and dark web activity. Its HNTR Platform works in a loop of discovery, validation and disruption. It maps domains, IPs, social accounts and executive profiles, then checks signals against a data graph of 12B+ signals with human analysts involved.
For disruption, ZeroFox uses analyst-guided takedown workflows and a Global Disruption Network of platform and infrastructure partners. Other modules cover dark web intelligence, intel feeds, an intelligence search portal, external attack surface management and physical security intelligence. It integrates with TIP, SIEM, SOAR and EDR tools.
Pricing is sold as bundles (Foundation, Core, Premium, Executive) plus add-ons, all quoted on request. It is aimed at enterprise security, corporate security and marketing teams.
Key features
- Brand impersonation monitoring and takedowns
- Lookalike domain and phishing site detection
- Executive protection with doxxing and PII removal
- Dark web monitoring of forums, markets and chats
- Compromised credential detection
- External attack surface management (EASM)
- Intel feeds and an analyst search portal
- Integrations with TIP, SIEM, SOAR and EDR
Use cases
Who it's for
Stopping brand impersonation
Find fake sites and social accounts that use a company's logo and remove them through takedowns.
Protecting executives
Watch for doxxing, deepfakes and impersonation of leaders, and remove exposed personal information.
Anti-phishing domain defense
Detect typosquatted and cloned domains and enforce takedowns before they reach customers.
Threat investigations
Use dark web intelligence and on-demand investigations to profile adversaries and respond to breaches or extortion.
ZeroFox pricing
From the vendor's site, checked Nov 11, 2026. Prices change — confirm on their pricing page.
| Plan | Foundation Bundle | Core Bundle | Premium Bundle | Executive Bundle |
|---|---|---|---|---|
| Price | Custombilled yearly | Custombilled yearly | Custombilled yearly | Custombilled yearly |
| Takedowns a year | 250 | 500 | 1,000 | 100 |
| Brand Protection | 2 | 5 | 50 | — |
| Domain Protection | 10 | 50 | 100 | — |
| Executive Protection | — | 10 | 100 | Essentials 10, Premium 5 |
| On-demand investigations a year | — | 5 | 20 | — |
| Also |
|
| — |
|
Get an email when ZeroFox changes its prices
One mail per change, a stop link in each. Nothing else.
How ZeroFox compares
- ZeroFox has no free plan, and neither do the 3 alternatives below.
- It offers an API, which none of the others do.
| Tool | Starts at | Free plan | Free trial | API | Open source | |
|---|---|---|---|---|---|---|
| ZZeroFox | Quote | — | — | — | ||
N Netcraft | Quote | — | — | — | — | ZeroFox vs Netcraft |
B Bolster | — | — | — | — | — | ZeroFox vs Bolster |
P Proofpoint | Quote | — | — | — | — | ZeroFox vs Proofpoint |
The closest alternatives in our directory by category. “Starts at” is the cheapest paid plan per month, as each vendor lists it.
Pros and cons
Strengths
- Covers brand, domain, executive and dark web threats in one platform
- Bundles include set yearly takedown quotas (250 to 1,000)
- Human analysts review threats to reduce false positives
- Takedown API connector and SIEM/SOAR integrations
Limitations
- All pricing is quote-based
- No self-serve or free plan
- Bundles cap the number of takedowns and protected assets
ZeroFox FAQ
How much does ZeroFox cost?
Pricing is quote-based. You can choose from Foundation, Core, Premium and Executive bundles plus add-ons, and you request pricing from sales.
What does ZeroFox protect?
Brands, domains, executives, and the external attack surface. It also covers dark web exposure and compromised credentials.
Does ZeroFox take down malicious content?
Yes. Bundles include yearly takedown quotas, carried out through analyst-guided workflows and its Global Disruption Network.
Does it integrate with other security tools?
Yes. It connects to TIP, SIEM, SOAR and EDR tools and includes a Takedown API connector.
Used ZeroFox? Rate it
Sign in to rate this tool and share how you use it.
ZeroFox
Contact for pricing