The standout feature for us is ZeroFox’s external threat intelligence and its automated brand protection capabilities. In particular, the platform is very strong at identifying rogue domain registrations and look-alike social media profiles that target our organization. Rather than having our team manually hunt down these phishing risks, the alerting engine flags them right away using high-fidelity indicators. The biggest value-add, though, is the managed takedown service. Having a built-in mechanism where ZeroFox handles the legal and technical heavy lifting to remove malicious infrastructure saves our security team hours of paperwork and weekly back-and-forth, and it directly lowers our mean time to remediation (MTTR). Review collected by and hosted on G2.com.

The platform can sometimes produce a lot of noise and false positives, especially during the initial setup of keyword monitoring for brand protection or executive profiles. Common names and generic terms may trigger frequent alerts that still need manual triage, which can temporarily stretch a small analyst team. Although the rules can be refined over time and the AI filtering does help, the early optimization period takes a meaningful time investment to bring alerting down to a consistently accurate baseline. Review collected by and hosted on G2.com.

I like ZeroFox for its easy-to-navigate consolidated dashboard and the customizable functionality that's all in one place. The ability to scan social media is a nice feature for us, despite our social media teams using a different solution. I find the price of the solution to be on par with the industry. I also appreciated the easier takedown process with ZeroFox and the potential for better integration into our ecosystem. Setting up ZeroFox was straightforward, aligning well with our cloud-only infrastructure as it didn't require deploying hardware, and there were no agents or software configurations needed, making it a fairly easy and intuitive experience. Review collected by and hosted on G2.com.

It's unclear when an automatic takedown is in process versus having to initiate a takedown. The request to submit evidence, sometimes when the takedown is for intellectual property, puzzles the team, and this isn't all the time making it difficult to predict. The contract terms for auto renewal are terrible, which has negatively impacted our perspective, especially during the renewal process. Because of these concerns, we're hesitant to expand our use of ZeroFox despite its potential. Review collected by and hosted on G2.com.

I like that ZeroFox gets a lot of alerts, and they have a team that combs through all the noise and escalates the alerts that are most relevant and need my team's attention. This is a big time saver. It's also a pretty easy program to learn with an easy user interface. I appreciate that if we come across some content we would like to submit to a social media network to take down, it's possible to email the ZeroFox team, and they will enter that content as an alert and be able to submit a takedown request even if their system originally missed it. Review collected by and hosted on G2.com.

Unfortunately, the security alerts are not filtered out by ZeroFox's team, and we get a lot of noise that's not relevant to our business. Also, the takedowns are a great concept in theory, but they often take quite a while to be successful, and a high percentage of them are never actually taken down. The promise is to clean up threatening accounts and posts for the brand, but in reality, some content we want removed doesn't get taken down. The initial setup wasn't as easy as I would have liked, with calibration issues on escalated alerts leading to irrelevant escalations. Lastly, ZeroFox is a fairly expensive platform, and it's tied heavily to the platform formerly known as Twitter, which isn't as mainstream now. There are limitations with other platforms like LinkedIn and TikTok, which ZeroFox cites as API limitations, but this means missing out on information we'd like to be alerted on. Review collected by and hosted on G2.com.

What makes it unique is what it delivers: I haven’t heard of any other product that does what Zerofox does. It takes a lot of the pressure off an analyst when it comes to blue-team activities and proactive threat hunting. Review collected by and hosted on G2.com.

Its rigidity around policy configurations, along with the rules layout and logic, can feel a bit overwhelming. Also, the ability to handle integrations isn’t in the customer’s hands; you have to log a ticket just to initiate or update a third-party integration, which can add unnecessary time. Review collected by and hosted on G2.com.

One of the new and most impactful aspects I appreciate about ZeroFox is how it delivers actionable external threat intelligence rather than just raw indicators. The platform effectively combines AI-driven monitoring with human analyst validation to identify real threats across social media, surface web, deep web, and dark web sources. This approach significantly reduces noise and false positives, which is extremely valuable for SOC teams working under time constraints. ZeroFox’s ability to detect phishing campaigns, brand impersonation activities, leaked credentials, and early threat‑actor discussions allows analysts to move from reactive response to proactive defense.

From a SOC operations standpoint, I particularly like how ZeroFox provides strong contextual enrichment clearly linking suspicious activity to adversary intent, targeted assets, and potential business impact. This context makes investigations faster and more effective, especially during high‑severity incidents involving phishing, account compromise, or data leakage. Additionally, its seamless integration with SIEM and SOAR platforms supports automated workflows such as alert ingestion, correlation, and response actions, which helps improve overall detection efficiency and incident response timelines. Overall, ZeroFox strengthens digital risk protection by extending security visibility beyond the traditional perimeter and empowering SOC analysts with intelligence that is practical, prioritized, and ready for action. Review collected by and hosted on G2.com.

While ZeroFox is a very strong platform for external threat intelligence and digital risk protection, there are a few areas where it could be further improved from a SOC analyst’s perspective. One key area is alert prioritization and customization. Although ZeroFox already reduces noise through analyst validation, giving SOC teams more granular control over alert thresholds, severity scoring, and use‑case‑based filtering would help align alerts more closely with specific organizational risk priorities and reduce additional triage effort during peak hours.

Another improvement area is deeper integration visibility with SIEM and SOAR tools. While ZeroFox integrates well with platforms like Microsoft Sentinel and other security stacks, enhanced out‑of‑the‑box correlation dashboards and clearer mapping between external intelligence and internal telemetry would make investigations even faster and more intuitive for analysts handling incidents end‑to‑end.

Additionally, expanding guided investigation workflows and SOC‑focused playbooks within the platform could further support junior analysts and new team members. More scenario‑based recommendations tied to phishing campaigns, credential leaks, or dark web chatter would help speed up response and ensure consistent investigation quality across shifts. Overall, these enhancements would further strengthen ZeroFox’s usability and operational efficiency for SOC teams without changing its already strong intelligence foundation. Review collected by and hosted on G2.com.

ZeroFox does a great job prioritizing alerts, which makes it easy to tackle the most important work first. The rules and prioritization settings are easy to customize to match our needs, and the support team has been fantastic. Review collected by and hosted on G2.com.

There can be some false positives with parked domains, which get flagged even though they can't actually be taken down — this adds some noise to the alerts. Takedowns can also take some time to complete; some resolve within 48 hours, while others can take weeks. Review collected by and hosted on G2.com.

It has the best ability to detect malicious sites and meta ads, which is very important for a hospitality company. Their turnaround on these alerts is also fast. Review collected by and hosted on G2.com.

The only thing I have a problem with is the lack of nuance in the alert alerting. I get the same level of alerting if I see a malicous Meta alert, or an exposed password from 6 years ago Review collected by and hosted on G2.com.

The 24/7 monitoring and reporting has saved us a significant amount of time as we no longer have to do manual searches or handle reporting/following up with individual platforms. Review collected by and hosted on G2.com.

Onboarding took quite a bit of time as our customer service reps kept changing which made the process quite frustrating. Review collected by and hosted on G2.com.

I like that it has an app and that I can see the alerts from anywhere. I also like that it is easy to learn and offers multiple ways of integration; for example, I have it quickly integrated with SLACK. Review collected by and hosted on G2.com.

The reports do not generate value for me, I think it is necessary to improve them, just like the queries, there is no ticket management or any way to group two or more alerts. Review collected by and hosted on G2.com.

Features, monitoring and alerting, ability to submit feedback to support, support responsivness Review collected by and hosted on G2.com.

Plentiful knowledge base documentation, sometimes hard to find specific item

Some of the rules that scan for info that alerts are generated for return useless info (i.e. comped creds with blank passwords)- there is ability to refine this I believe Review collected by and hosted on G2.com.