ZeroFox
| Company type | Public |
|---|---|
| Industry | Cybersecurity |
| Founded | 2013 |
| Headquarters | Baltimore, Maryland , United States |
Area served | Worldwide |
| Products | Cloud-delivered software as a service (SaaS) platforms for threat detection and response |
ZeroFox Holdings, Inc. is a U.S.-based cybersecurity company located in Baltimore, Maryland. It offers cloud-delivered software as a service (SaaS) platforms designed to assist organizations in identifying and countering phishing attacks, fraudulent schemes, botnet operations, credential compromises, impersonation attempts, data leaks, and physical threats aimed at brands, domains, employees, and assets.
History
Initially established in 2013 under the name Riskive, the company rebranded to ZeroFox within months. Its origins trace back to an 8,000-square-foot workspace at Betamore, a startup accelerator situated in Baltimore’s Federal Hill district.
In 2015, ZeroFox raised $27 million through a Series B funding round. By the following year, it had relocated to an 18,000-square-foot site housed in a former Pabst Brewing facility in South Baltimore. In 2017, the firm secured $40 million in funding led by Redline Capital Management and Silver Lake Waterman, with participation from earlier investors like New Enterprise Associates, bringing total investments to $88 million.
ZeroFox partners with industry leaders such as IBM, Hootsuite, Splunk, ThreatQuotient, and Google Cloud to bolster its threat detection and response solutions. Notably, its collaboration with Google Cloud centers on shielding users from phishing-related domains.
In 2020, the company completed a $74 million financing round spearheaded by Intel Capital—marking one of the largest recent investments for a cybersecurity firm based in Maryland—and increasing total capital raised to $162 million.
The firm entered public markets on August 4, 2022, through a $1.4 billion SPAC deal that included acquiring ID Experts Holdings, Inc. (“IDX”). The combined organization now operates as ZeroFox Holdings, Inc., trading on Nasdaq under the symbols “ZFOX” for common shares and “ZFOXW” for warrants.
Acquisition
On February 6, 2024, ZeroFox announced it had reached a definitive agreement to be acquired by Haveli Investments, a private equity entity focused on enterprise software and cybersecurity sectors. The all-cash deal valued ZeroFox at roughly $350 million. Haveli Investments finalized the purchase on May 13, 2024.
Acquisitions
- October 2020: ZeroFox purchased Cyveillance from LookingGlass and integrated its dark web intelligence and threat detection capabilities into the ZeroFox Digital Risk Protection Platform.
- July 2021: The firm acquired Vigilante, specializing in dark web threat intelligence.
- August 2022: ZeroFox expanded by acquiring IDX, a company focused on breach response services.
- April 2023: The company added LookingGlass Cyber Solutions to its portfolio; LookingGlass specializes in external attack surface management and threat intelligence.
Surveillance of Freddie Gray protests
In 2015, ZeroFox attracted criticism for monitoring protests following Freddie Gray’s death. The company notably categorized peaceful activists such as DeRay McKesson and Johnetta Elzie as significant physical threats despite their lack of criminal involvement. Additionally, ZeroFox failed to differentiate between fake troll accounts impersonating Elzie and her authentic social media profiles.
FBI contract and the January 6 Capitol Attack
On December 30, 2020, ZeroFox was awarded a $14 million contract to provide social media intelligence services to the FBI, taking over from Dataminr, whose contract concluded on December 31, 2020. This handover occurred amid a decline in online threat detection prior to the January 6, 2021, Capitol insurrection. FBI personnel encountered difficulties adjusting to ZeroFox’s platform, raising concerns about reduced surveillance effectiveness, particularly on Twitter. The transition generated internal dissatisfaction and confusion, with some agents perceiving ZeroFox as a step back during a crucial moment of extremist activity escalation.