# ZeroFox vs Recorded Future: which do AI models recommend for DRP, October 2026

IT AI Recommendation Index, October 2026 Edition, Digital risk protection. One of fourteen models named ZeroFox first on the direct prompt; zero named Recorded Future. Page: https://it-ai-index.com/security/digital-risk-protection/zerofox-vs-recorded-future/

| | First-choice share | Rank | Negative rate | Labels | Models naming it |
|---|---|---|---|---|---|
| ZeroFox | 14% | #2 of 11 | 23% | 47 | 14 of 14 |
| Recorded Future | 4% | #5 of 11 | 34% | 35 | 13 of 14 |

## The direct prompt, model by model

- GPT-5.4 mini: zerofox first (first choices: ZeroFox) (alternatives: Bitsight, Proofpoint Digital Risk Protection, SecurityScorecard, UpGuard BreachSight)
- Gemini 3.5 Flash: neither first, one named (first choices: SOCRadar Extended Threat Intelligence) (alternatives: Flare, UpGuard BreachSight, ZeroFox)
- Grok 4.1 Fast: neither first, one named (first choices: UpGuard BreachSight) (alternatives: Rapid7 Threat Command, ZeroFox)
- Mistral Small: neither first, one named (first choices: UpGuard BreachSight) (alternatives: Kaduu, Recorded Future)
- DeepSeek V4 Flash: neither first, one named (first choices: UpGuard BreachSight) (alternatives: Netcraft, Rapid7, SOCRadar Extended Threat Intelligence, ZeroFox)
- Llama 4 Maverick: neither first, one named (first choices: Fortra Brand Protection) (alternatives: Kaduu, Recorded Future, UpGuard BreachSight)
- Qwen 3.7 Flash: neither first, one named (first choices: Rapid7) (alternatives: Corvus Logic, Cyberhaven, Recorded Future, ThreatConnect)
- Kimi K2: neither first, one named (first choices: UpGuard BreachSight) (alternatives: Fortra Brand Protection, ZeroFox)
- MiniMax M2.5: neither first, one named (first choices: UpGuard BreachSight) (alternatives: CrowdStrike Falcon, Group-IB Digital Risk Protection, Recorded Future, ZeroFox)
- GPT-6 Luna: neither first, one named (first choices: CybelAngel Core) (alternatives: Bolster, BrandShield, ZeroFox)
- Claude Haiku 4.5: neither named (first choices: Cyble Vision) (alternatives: BlueVoyant Sky, CrowdStrike Falcon, Rapid7 Threat Command, UpGuard BreachSight)
- Perplexity Sonar: neither named (first choices: Rapid7 Threat Command, UpGuard BreachSight) (alternatives: CybelAngel)
- GLM 4.7 FlashX: neither named (first choices: UpGuard BreachSight) (alternatives: Bolster)
- Muse Glimmer 30B: neither named (first choices: UpGuard BreachSight) (alternatives: CybelAngel)

## What the models said about ZeroFox

- "Users frequently report problems with inefficient alerts, slow performance ... and a high volume of false positives." (Mistral Small, negative prompt, hard negative)
- "What to avoid (If budget is truly limited):- ZeroFox: Median contract value is ~$45,000/year." (DeepSeek V4 Flash, budget prompt, hard negative)
- "ZeroFox – Multiple User Complaints - False positive overload" (Kimi K2, negative prompt, hard negative)
- "Broad external-threat coverage spanning brand and domain abuse, social platforms, executive risks... Look closely at ZeroFox." (GPT-6 Luna, comparative prompt, first choice)
- "If brand, executive, and social media protection with rapid takedowns are your top priorities → ZeroFox" (DeepSeek V4 Flash, comparative prompt, first choice)
- "ZeroFox is highly regarded for its automated threat intelligence, brand defense, and executive protection." (Gemini 3.5 Flash, comparative prompt, first choice)

## What the models said about Recorded Future

- "What to avoid ... Recorded Future: Quote-based, but generally above $10,000/year." (DeepSeek V4 Flash, budget prompt, hard negative)
- "Recorded Future is cited as an example of this trade-off: * Weaknesses: * Limited social media monitoring compared to platforms specializing in brand protection" (Muse Glimmer 30B, negative prompt, soft negative)
- "Top-ranked for threat intel and DRP, but complaints include high costs, setup complexity, alert fatigue (less relevant noise), and limited automation" (Grok 4.1 Fast, negative prompt, soft negative)
- "Strong threat intelligence integration, excels at contextualizing exposed data, dark web chatter, and threat actor signals." (Mistral Small, comparative prompt, first choice)
- "If you want deep threat intelligence context (understanding who is attacking and why) → Recorded Future" (DeepSeek V4 Flash, comparative prompt, first choice)
- "From leaders like Recorded Future (strong intel), ZeroFox (takedowns), Rapid7 (SOC integration)." (Grok 4.1 Fast, scale prompt, first choice)

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category. Comparisons are drawn for the top eight products in each category. Published under CC BY 4.0; the output is the models' output, and nothing here is a recommendation by the index.