ZeroFox and the business of making threats disappear

The troubling question was almost embarrassingly simple: was this a real business? Customers of loveholidays, the online travel company, were encountering impersonators on social media and the web. Some lost money. Inside the company, staff were hunting for fakes and pursuing removals through scattered manual processes. A holiday booking problem had become a security problem. The company’s own systems did not have to be breached for its customers to get hurt.

That is the opening ZeroFox occupies. Founded in 2013 by James C. Foster and Evan Blair, the Baltimore company sells external cybersecurity: protection against threats involving infrastructure, accounts and conversations an organization often does not own. Its territory includes phishing websites, stolen credentials, fraudulent profiles and personal information exposed online. The perimeter is wherever someone can convincingly pretend to be you.

The spreadsheet gives up first

At loveholidays, the first failure was visibility. Staff could not reliably see the impersonation problem’s full extent. Removal was another lottery: some platforms acted within hours; others left fake accounts operating. ZeroFox’s case study describes replacing spreadsheets and individual follow-ups with centralized detection and managed takedowns. Marketing staff could review alerts and request action themselves.

“We lacked a clear understanding of the scope of these external threats”

Grant Cassin / Information Security Manager, loveholidays

The useful change was organizational as much as technical. Discovery, review and removal became a shared process. An information security manager no longer had to shepherd every request across separate websites. ZeroFox’s customer account is a vendor-published case study, but the operational lesson travels well: assign responsibility for the work after detection.

An alert needs somewhere to go

ZeroFox describes its operating cycle with three verbs: discover, validate, disrupt. Discovery collects signals across public platforms and harder-to-reach sources. Validation asks whether those signals concern a protected customer, represent a credible threat and justify intervention. Disruption carries evidence into blocking and removal workflows. What comes back informs the next search.

Consider a lookalike login page. Recognizing the copied logo helps, but someone must connect it to a customer, establish the abuse and send a defensible request to the relevant provider. ZeroFox combines automated analysis with investigators and a Global Disruption Network of infrastructure and platform relationships. Its expertise includes closed-source intelligence, exposure validation and the procedural work of enforcement.

Those relationships matter because the internet has many landlords. A registrar, hosting company and social platform have different responsibilities and rules. Blocking a dangerous URL can reduce exposure while a removal request proceeds. Neither action guarantees that the attacker will stop trying. The practical measure is how long customers remain exposed, including when the campaign resurfaces.

A market between the tools

The buyers include threat intelligence teams, security operations centers, corporate security departments and people responsible for brand trust. ZeroFox reports thousands of customers worldwide across sectors including finance, healthcare, retail and government. Its product portfolio spans cyber threat intelligence, brand and domain protection, attack surface intelligence and physical security intelligence.

Competition depends on the assignment. Recorded Future overlaps in intelligence; Netcraft and Bolster compete in protection and disruption; BlackCloak addresses executive protection. ZeroFox’s pitch joins these adjacent jobs in one operating cycle. Buyers should test the quality of that connection: can an investigation become an action without staff rebuilding the case in another tool?

The business model makes the workload tangible. Subscriptions package protected brands, domains and executives alongside seats, investigations and annual takedown allowances. The published Foundation bundle includes 250 takedowns a year; the Core bundle includes 500. Contracts are quoted to the customer. Managed intelligence and professional services add human capacity to the software subscription.

The company had its own reset

Building that breadth required capital and acquisitions. Intel Capital led a $74 million financing in 2020. ZeroFox acquired the Cyveillance intelligence business that year, combined with breach-response provider IDX when it went public in 2022, and added LookingGlass in 2023. The announced LookingGlass deal was approximately $26 million, primarily in stock, with other consideration and adjustments.

The public chapter was short. Haveli Investments completed its acquisition in May 2024 after announcing an enterprise value of approximately $350 million. Shares ceased trading. Management presented the return to private ownership as a way to gain flexibility and accelerate investment. A special board committee had evaluated capital structure alternatives before recommending the sale.

The finances supply useful friction. ZeroFox reported $233.3 million in consolidated revenue for the year ended January 31, 2024, alongside a $356.3 million net loss. That loss included substantial impairment charges. These are historical group figures, covering more than the core protection subscription. They show why revenue alone cannot settle the question of business performance.

Now the executive is part of the map

Under current CEO David Muse, ZeroFox launched HNTR in July 2026, with executive protection as its first dedicated application. Its coverage considers digital exposure, family, residences and travel. The underlying proposition is that online information can give security teams an earlier opportunity to assess a physical threat.

Recent additions also tackle verification and reporting. A June 2026 Reality Defender partnership brings synthetic-media detection into investigations. AI Analytics, launched that month, lets teams explore security data through dashboards and the Scout assistant. Human review remains part of the operating model. The careers page’s stated values - people, innovation and trust - sit comfortably beside that emphasis on judgment.

Ask what happens tomorrow

There are limits worth understanding before purchase. A platform or host controls its own enforcement. Evidence, legal grounds and access to sources affect what can be achieved. An external protection service also leaves internal patching, identity controls and incident ownership on the customer’s agenda. Broad monitoring only helps when someone can make decisions from it.

The part readers can copy costs no software budget: define the assets and people that matter, name the person who can authorize action, preserve evidence and check whether the abuse returns. ZeroFox’s business rests on making that sequence repeatable. For a customer staring at a convincing fake, the decisive question is refreshingly practical: who is handling this now?