ZeroFox

ZeroFox is an American external cybersecurity company headquartered in Baltimore, Maryland. Its business is centered on identifying threats that originate outside an organization’s conventional security perimeter, including phishing and fraud campaigns, impersonation, credential theft, exposed data, botnet activity, malicious domains, dark-web activity, and selected physical threats. The company delivers much of this capability through cloud-based software-as-a-service products designed to help organizations discover, investigate, prioritize, and disrupt threats directed at their brands, domains, employees, customers, executives, and other assets. The company was created in 2013 under the name Riskive and adopted the ZeroFox name several months later. It began operations in Betamore, a Baltimore startup incubator, where it occupied an approximately 8,000-square-foot space. As the business expanded, it moved in 2016 to an approximately 18,000-square-foot facility in a former Pabst Brewing site in South Baltimore. Early financing supported the development of its external threat-detection and digital-risk capabilities. ZeroFox raised $27 million in a Series B financing in 2015. A further 2017 financing led by Redline Capital Management and Silver Lake Waterman brought total reported funding to $88 million, with participation from earlier investors including New Enterprise Associates, Highland Capital Partners, and Core Capital. In 2020, Intel Capital led a further $74 million financing round, bringing reported cumulative backing to $162 million. ZeroFox expanded its platform through technology partnerships and acquisitions. Its partnerships have included IBM, Hootsuite, Splunk, ThreatQuotient, and Google Cloud. These relationships supported integrations for security operations, threat visualization, social-media monitoring, incident analysis, and phishing-domain warnings. The company acquired Cyveillance from LookingGlass in 2020 to add threat-intelligence and dark-web data capabilities, followed by the acquisition of dark-web intelligence company Vigilante in 2021. In 2022, ZeroFox acquired breach-response provider ID Experts Holdings, commonly known as IDX, as part of its public-market transaction. It acquired LookingGlass Cyber Solutions in 2023, adding external attack-surface management and threat-intelligence capabilities. ZeroFox became a public company on August 4, 2022, through a business combination with a special-purpose acquisition company. The transaction valued the combined enterprise at approximately $1.4 billion according to the cited reference material and resulted in the corporate name ZeroFox Holdings, Inc. The company’s common stock traded on Nasdaq under ZFOX, while its warrants traded under ZFOXW. The public-company period ended after ZeroFox agreed in February 2024 to be acquired by Haveli Investments in an all-cash transaction with an announced enterprise value of approximately $350 million. Haveli completed the purchase on May 13, 2024, taking the company private. In November 2024, ZeroFox divested its IDX subsidiary to Kingswood Capital Management. ZeroFox’s history also includes public criticism regarding its handling of social-media intelligence. During the 2015 protests following the death of Freddie Gray in Baltimore, the company classified nonviolent protest organizers DeRay McKesson and Johnetta Elzie as high physical threats to law enforcement. Critics argued that the system failed to distinguish impersonating or trolling accounts from Elzie’s authentic social-media presence and improperly characterized people who were not accused of criminal conduct. The company also supplied social-media intelligence to the FBI under a $14 million contract beginning December 30, 2020. Reporting about the transition from Dataminr associated the changeover with reduced visibility before the January 6, 2021 attack on the United States Capitol, generating further scrutiny of the contract and its operational effe…

ZeroFox originated in Baltimore in 2013 under the name Riskive. The startup changed its name to ZeroFox within months and began operating from Betamore, a startup incubator in the Federal Hill neighborhood. Its early business developed around the idea that organizations needed visibility beyond their managed networks: attackers could exploit public websites, social-media accounts, domains, criminal forums, exposed credentials, and other external assets even when internal security controls were functioning. The company expanded its Baltimore footprint as it grew. In 2016, it left its approximately 8,000-square-foot incubator space for an approximately 18,000-square-foot location in a former Pabst Brewing facility in South Baltimore. Financing supported this expansion and the development of its cloud-based software. ZeroFox raised $27 million in Series B funding in 2015. In 2017, Redline Capital Management and Silver Lake Waterman led another financing, joined by New Enterprise Associates, Highland Capital Partners, and Core Capital. The cited account reported that the round brought cumulative funding to $88 million. Intel Capital led a further approximately $74 million round in 2020, bringing reported cumulative backing to $162 million. ZeroFox built its platform through integrations with established technology providers. Its cited partners included IBM, Hootsuite, Splunk, and ThreatQuotient, while its relationship with Google Cloud supported warnings about phishing domains. These partnerships reflected the company’s effort to make external threat intelligence useful inside security operations, collaboration, analytics, and incident-response workflows. Acquisitions became a major part of the company’s expansion. In October 2020, ZeroFox acquired Cyveillance from LookingGlass. The transaction was intended to combine Cyveillance’s threat-intelligence collection and dark-web capabilities with the ZeroFox Digital Risk Protection Platform. In July 2021, ZeroFox acquired Vigilante, another dark-web threat-intelligence business. In August 2022, it acquired ID Experts Holdings, adding breach-response capabilities. In April 2023, it acquired LookingGlass Cyber Solutions, broadening its external attack-surface management and threat-intelligence portfolio. ZeroFox entered the public markets on August 4, 2022, through a business combination with a special-purpose acquisition company. The transaction was described in the cited material as a $1.4 billion deal. The resulting public company was named ZeroFox Holdings, Inc., with common stock trading on Nasdaq under ZFOX and warrants under ZFOXW. The public-company period was relatively short. On February 6, 2024, ZeroFox announced a definitive agreement for Haveli Investments to acquire it in an all-cash transaction with an announced enterprise value of approximately $350 million. Haveli completed the purchase on May 13, 2024, taking ZeroFox private. In November 2024, the company divested its IDX subsidiary to Kingswood Capital Management. The company has also faced criticism over the use of its intelligence products. During Baltimore’s 2015 protests following Freddie Gray’s death, ZeroFox classified nonviolent organizers DeRay McKesson and Johnetta Elzie as high physical threats to law enforcement. Critics said the system did not adequately separate impersonating troll accounts from Elzie’s genuine social-media presence and treated organizers as threats despite the absence of allegations that they had committed crimes. Separately, ZeroFox assumed a reported $14 million FBI social-media intelligence contract from Dataminr on December 30, 2020. The handover and its effect on intelligence visibility before the January 6, 2021 Capitol attack became a subject of public scrutiny. These episodes illustrate both the company’s role in high-stakes external intelligence and the risks associated with automated threat classification.

1. 2024Taken private by Haveli Investments

   Haveli Investments completed its acquisition of ZeroFox Holdings on May 13, 2024.

   Source
2. 2024IDX divested

   ZeroFox divested its IDX subsidiary to Kingswood Capital Management in November 2024.

   Source
3. 2023Acquisition of LookingGlass Cyber Solutions

   ZeroFox acquired LookingGlass Cyber Solutions to add external attack-surface management and threat intelligence.

   Source
4. 2022Public listing and acquisition of IDX

   ZeroFox completed its SPAC transaction, became publicly traded as ZFOX, and acquired ID Experts Holdings.

   Source
5. 2021Acquisition of Vigilante

   ZeroFox acquired dark-web threat-intelligence company Vigilante.

   Source
6. 2020Intel Capital leads new financing

   ZeroFox closed a reported $74 million financing round led by Intel Capital, bringing reported total backing to $162 million.

   Source
7. 2020Acquisition of Cyveillance

   ZeroFox acquired Cyveillance from LookingGlass to strengthen threat intelligence and dark-web monitoring.

   Source
8. 2017Funding reaches a reported $88 million

   A financing led by Redline Capital Management and Silver Lake Waterman, with participation from earlier investors, brought reported cumulative funding to $88 million.

   Source
9. 2016Moves to a larger Baltimore facility

   The company moved from its Betamore incubator space into a larger former Pabst Brewing facility in South Baltimore.

   Source
10. 2015Series B financing

    ZeroFox raised a reported $27 million in Series B funding.

    Source
11. 2013Company founded as Riskive

    The Baltimore cybersecurity startup was established under the name Riskive and adopted the ZeroFox name several months later.

    Source

ZeroFox positions itself as an external cybersecurity and digital-risk protection provider. Rather than focusing only on internal networks and endpoints, its offering emphasizes discovering and disrupting threats across the open web, social platforms, criminal marketplaces, the dark web, domains, exposed infrastructure, and other external channels.

• ZeroFox Digital Risk Protection PlatformDigital risk protection

  The Digital Risk Protection Platform is the company’s central cloud-based offering for monitoring and responding to threats outside an organization’s traditional security boundary. Its scope includes brand impersonation, phishing, fraudulent domains, exposed credentials, data leaks, malicious social-media activity, botnet exposure, and other external risks. The platform is intended to help security teams identify assets and threats, connect related intelligence, prioritize incidents, and support disruption or takedown actions.

• External attack-surface managementAttack-surface management

  ZeroFox’s external attack-surface capabilities focus on discovering and assessing internet-facing assets associated with an organization. The approach is designed to reveal domains, infrastructure, services, and other externally visible resources that may be unknown, misconfigured, impersonated, or exposed to attack. This capability was strengthened through the 2023 acquisition of LookingGlass Cyber Solutions.

• Threat intelligence and dark-web monitoringThreat intelligence

  ZeroFox provides intelligence on threats appearing across criminal forums, dark-web marketplaces, social platforms, and other external sources. The company expanded this area through its acquisitions of Cyveillance in 2020 and Vigilante in 2021. The resulting data and analysis are intended to identify stolen credentials, planned attacks, exposed information, malicious actors, and indicators that can be used by security and response teams.

• Breach response and identity protectionBreach response2022

  ZeroFox added breach-response capabilities through its acquisition of ID Experts Holdings, associated with the IDX business, in 2022. These capabilities complemented the company’s external threat monitoring by addressing response and identity-protection needs after data compromise. ZeroFox later divested IDX to Kingswood Capital Management in November 2024, so this offering is no longer part of the company’s retained portfolio.

• 2024Agree to sale to Haveli InvestmentsM&A

  After a period as a Nasdaq-listed company, ZeroFox agreed to a private-equity acquisition.

  What changed. ZeroFox announced an all-cash agreement under which Haveli Investments would acquire the company.

  Aftermath. Haveli completed the acquisition on May 13, 2024, taking ZeroFox private.

  Announced enterprise value. Approximately $350 million (Agreement announced February 6, 2024; completed May 13, 2024)

  Source
• 2024Divest IDXM&A

  Following the change in ownership, ZeroFox separated its breach-response and identity-protection subsidiary from the retained external cybersecurity business.

  What changed. ZeroFox sold or divested IDX to Kingswood Capital Management in November 2024.

  Aftermath. IDX ceased to be part of ZeroFox’s retained operating portfolio.

  Source
• 2023Acquire LookingGlass Cyber SolutionsM&A

  ZeroFox aimed to strengthen the external asset-discovery and attack-surface side of its cybersecurity platform.

  What changed. It acquired LookingGlass Cyber Solutions, an external attack-surface management and threat-intelligence company.

  Aftermath. The acquisition expanded ZeroFox’s capabilities for discovering and analyzing internet-facing assets and external threats.

  Source
• 2022Complete SPAC transaction and acquire IDXM&A

  ZeroFox pursued a public-market transaction while broadening its cybersecurity services into breach response.

  What changed. The company completed its SPAC combination on August 4, 2022, and acquired ID Experts Holdings as part of the transaction.

  Aftermath. The combined business became ZeroFox Holdings, Inc. and traded on Nasdaq under ZFOX, with warrants under ZFOXW.

  Announced transaction value. $1.4 billion (August 4, 2022)

  Source
• 2021Acquire VigilanteM&A

  The company was expanding its ability to monitor threats in dark-web environments.

  What changed. ZeroFox acquired Vigilante, a dark-web threat-intelligence company.

  Aftermath. The transaction added further dark-web intelligence capabilities to ZeroFox’s portfolio.

  Source
• 2020Acquire CyveillanceM&A

  ZeroFox sought to deepen its external threat-intelligence and dark-web monitoring capabilities.

  What changed. It acquired Cyveillance from LookingGlass and integrated its intelligence resources with the ZeroFox Digital Risk Protection Platform.

  Aftermath. The acquisition broadened the data and monitoring base supporting ZeroFox’s external-risk products.

  Source

• 2021Scrutiny of FBI intelligence transition before the Capitol attackControversy

  ZeroFox’s assumption of the FBI’s social-media intelligence contract from Dataminr on December 30, 2020, was later associated with reported reductions in visibility before the January 6, 2021 attack on the United States Capitol. The transition and the contract’s operational performance became subjects of public criticism and scrutiny.

  Source
• 2015Criticism over surveillance of Freddie Gray protest organizersControversy

  ZeroFox was criticized for classifying nonviolent Baltimore protest organizers DeRay McKesson and Johnetta Elzie as high physical threats to law enforcement during demonstrations following Freddie Gray’s death. Critics also said the company’s system failed to distinguish impersonating troll accounts from Elzie’s authentic social-media activity. The episode raised concerns about automated threat labeling, protest monitoring, and the treatment of people who were not suspected of criminal conduct.

  Source

• 2024ZeroFox agrees to be acquired by Haveli Investments

  ZeroFox announced on February 6, 2024, that it had entered into an agreement for Haveli Investments to acquire the company in an all-cash transaction with an announced enterprise value of approximately $350 million.

  M&A
  Source
• 2024Haveli Investments completes the acquisition of ZeroFox

  Haveli Investments completed its purchase of ZeroFox Holdings on May 13, 2024, ending ZeroFox’s period as a Nasdaq-listed public company and taking the business private.

  M&A
  Source
• 2024ZeroFox divests IDX to Kingswood Capital Management

  ZeroFox divested its IDX subsidiary to Kingswood Capital Management in November 2024.

  M&A
  Source
• 2023ZeroFox acquires LookingGlass Cyber Solutions

  ZeroFox acquired LookingGlass Cyber Solutions, adding external attack-surface management and threat-intelligence capabilities to its portfolio.

  M&A
  Source
• 2022ZeroFox becomes a publicly traded company

  ZeroFox completed a business combination with a special-purpose acquisition company on August 4, 2022. The combined company was named ZeroFox Holdings, Inc.; its common stock traded under ZFOX and its warrants under ZFOXW.

  M&A
  Source
• 2022ZeroFox acquires ID Experts Holdings

  As part of its public-market transaction, ZeroFox acquired ID Experts Holdings, a breach-response company whose business was commonly associated with the IDX name.

  M&A
  Source
• 2021ZeroFox acquires Vigilante

  ZeroFox acquired Vigilante, a company focused on dark-web threat intelligence, extending its monitoring and intelligence capabilities in criminal online environments.

  M&A
  Source
• 2020ZeroFox closes a $74 million financing round led by Intel Capital

  ZeroFox announced a new financing round led by Intel Capital. The cited reference material described the round as approximately $74 million and said it raised the company’s reported cumulative backing to $162 million.

  Other
  Source
• 2020ZeroFox acquires Cyveillance

  ZeroFox acquired Cyveillance from LookingGlass, combining Cyveillance’s threat-intelligence and dark-web data capabilities with the ZeroFox Digital Risk Protection Platform.

  M&A
  Source
• 2020ZeroFox signs a social-media intelligence contract with the FBI

  ZeroFox took over a reported $14 million FBI social-media intelligence contract from Dataminr on December 30, 2020. The transition later became part of scrutiny concerning intelligence visibility before the January 6 Capitol attack.

  RegulationOther
  Source

1. ZeroFox