James C. Foster and the trouble outside the fence

James C. Foster acquired his professional name by getting into trouble. After college, working at the Department of Defense, he was being told to fix something when his first name disappeared from the instructions. Foster, apparently, was sufficient. He has been Foster ever since. It is a useful name for a security executive: brief, easy to shout, unlikely to get lost in an emergency.

Years later, asked to choose a favorite memory of building ZeroFox, he offered two contenders. One was the company's first holiday party. The other was ringing Nasdaq's closing bell in August 2022. A small gathering and a public-market ceremony had somehow ended up level. The common ingredient was the people who had come along for the ride.

That pairing gets closer to Foster than a list of acquisitions can. He is an engineer who became a company builder, an author who has done cybersecurity stand-up, and a founder whose business depended on persuading customers to worry about a place they did not control. For much of his career, the interesting trouble has been outside the fence.

A firewall has a rather literal blind spot

ZeroFox, which Foster co-founded in 2013, began with social media. Companies were using public platforms to find customers, recruit employees and speak to the world. Attackers could use those same platforms. A corporate security team might have good defenses around its own network while a convincing imitation of its brand operated somewhere else entirely.

The idea is easier to grasp without the industry's vocabulary. A fake account can borrow the appearance of a real business. A fraudulent website can trade on an established name. Customers encountering either may have no reason to know that the company's security perimeter ends well before the page they are looking at. The boundary on an IT diagram means very little to someone who has just been deceived.

In 2014, Foster was already arguing that attackers could adapt faster than traditional defenses. His explanation emphasized their freedom to change tactics. The task for a business was to identify its important assets and protect them in layers, including the social accounts through which people increasingly encountered it. Buying another appliance would hardly settle the matter if the fraud was happening on somebody else's platform.

“Right now, the hackers are winning.”

Foster, in a 2014 interview

There was a sales problem inside the security problem. Customers had to recognize the exposure before they could budget to reduce it. Foster later described the difficulty of establishing a category in an already crowded market. Selling protection against a familiar danger is one job. Explaining why the customer has overlooked a whole neighborhood of danger adds a second.

Before the fox, an engineer

Foster's route into that problem started in software engineering. He earned a bachelor's degree at Capitol Technology University, then worked as a civilian specialist supporting the Department of Defense. His early career also included Guardent and Foundstone, businesses later acquired by VeriSign and McAfee. Those were chapters in an existing security industry, before ZeroFox asked customers to redraw its borders.

In 2006 he founded Ciphent, a cybersecurity services and technology business. By the time Accuvant acquired it in 2010, it had grown to nearly a hundred employees and about a thousand customers. Foster went on to serve as a senior vice president and advisory-board chairman at Accuvant. Building a security company meant learning the machinery around the software: customers, staffing, delivery and the awkward work of combining organizations.

His education also includes study at Wharton. The combination is visible in the subjects he returns to publicly. He can discuss how attacks work, then move to recurring revenue, acquisitions and the economics of retaining customers. Security has a technical core, but the company selling it still has to survive the ordinary arithmetic of business.

In a 2018 business interview, he dwelled on differences of a few percentage points. A five-point change in customer retention, he explained, could change the trajectory of a company. Margins deserved the same attention. The remark is revealing because it is so uncinematic. A founder's grand vision may attract an audience; renewal rates have to pay the people who turn up on Monday.

The office you could walk to

There was another calculation behind ZeroFox's Baltimore roots: Foster wanted to walk to work. He had lived on South Baltimore's peninsula for 15 years. When he discussed the company's connection to the neighborhood in 2022, he talked about its history and feel, and about employees being able to walk outside for a call or lunch.

It is an unusually tangible answer to the question of headquarters. Technology companies can describe location in terms of talent pools, transport links and investor access. Foster's explanation also included the experience of an ordinary working day. The company could reach customers around the world while giving the people in its home office somewhere pleasant to stretch their legs.

As work patterns changed, the office's purpose changed too. Training, brainstorming and collaboration became reasons to come together. ZeroFox also brought its geographically dispersed employees to Baltimore for an annual conference. The local base served as a meeting point for people who did not share a daily commute, or even a continent.

The company's employees were called Foxes. Its workplace acquired the inevitable name Fox Den. Corporate animal metaphors can get loose quickly, but this one at least had a practical advantage: everyone knew which species they had joined.

A bell, some confetti, and the next morning

On August 4, 2022, Foster rang the closing bell at Nasdaq MarketSite in Times Square. ZeroFox had combined with L&F Acquisition Corp., a special purpose acquisition company, and IDX. The shares traded under ZFOX. A business founded around a neglected security problem now had a stock-market symbol, a ceremony and a much larger audience examining its performance.

The transaction joined external-threat protection with IDX's breach-response and digital-privacy business. It also compressed several ambitions into one deal: become public, raise growth capital and complete an acquisition. Foster described the structure as fitting those combined aims. The bell celebrated a financial transaction, but behind it sat a decision about what sort of security company ZeroFox intended to become.

Growth had already involved buying capabilities. Cyveillance joined in 2020, Vigilante in 2021, IDX in 2022 and LookingGlass Cyber Solutions in 2023. The sequence broadened the business across threat intelligence, monitoring and response. Each acquisition also brought employees whose methods and experience had to find a place in the larger company.

The public chapter ended less than two years after it began. Haveli Investments completed its acquisition of ZeroFox on May 13, 2024. The transaction had an enterprise value of approximately $350 million; stockholders received $1.14 a share, and trading ceased. The sale price was far below the roughly $1.4 billion valuation associated with the earlier announcement of the public-company deal.

That belongs in the story beside the confetti. A growing operation and a rewarding public investment are different measures, and the listing ceremony could guarantee neither. Later that May, ZeroFox named Dave Muse CEO. Foster's long stretch leading the company had reached a change of guard.

Books, boardrooms, and a wrestling mat

There are less predictable entries on Foster's professional record. He has written more than a dozen books, holds patents and has spoken at Black Hat, RSA and on Capitol Hill. His public work has included explaining threats to audiences with very different levels of technical knowledge. A congressional briefing and a security conference may concern the same internet, but they seldom require the same opening sentence.

He has also performed cyber-themed stand-up in Las Vegas. That detail sits comfortably beside his willingness to tell the story of being shouted at early in his career. He can let the joke land on himself. Cybersecurity supplies plenty of alarming material; making an audience laugh about it requires a different sort of timing.

Outside work, his interests include reading, the outdoors and supporting Team USA Greco-Roman wrestling. His public biography also describes time with his wife and four children. These details give a little scale to a career usually measured in customers and transactions: books to read, people to come home to, a sport whose contests have a much clearer boundary than the internet.

Another job beyond the familiar boundary

In April 2025, Foster announced that he was joining NightDragon as an operating partner. Dave DeWalt, whom he described as a longtime friend, was part of the attraction. Foster wanted to apply his experience to other security businesses, including the work of aligning teams, making acquisitions and expanding internationally. Later that year he became CEO of IronCircle, a cybersecurity workforce platform built around AI and practical training.

On March 19, 2026, eSentire appointed him chief executive, succeeding the retiring Kerry Bailey. The company brought a different starting point: an established managed detection and response operation, serving more than 2,000 organizations in over 80 countries. Foster's new responsibility was to lead a business combining its Atlas platform with threat hunters and security analysts.

His stated aim there is to bring human expertise and AI to the pace of modern attacks, stopping threats before they interrupt a customer's business. It extends a concern that runs through his earlier work: the attacker will keep changing, so the organization defending the customer has to change too. There is no final bell to ring for that assignment. There is, presumably, still something for Foster to fix.