2 categories · RankedZeroFox
Standing by category
| Category | Function | Share | Rank | Negative rate | Labels | Quadrant | Since September 2026 |
|---|---|---|---|---|---|---|---|
| Digital risk protection | Security operations | 14% | 2 of 86 | 23% | 47 | accepted challenger | |
| Deception technology | Security operations | 0% | 76 of 94 | 0% | 1 | under 10 labels · led by Thinkst Canary at 37% |
Movement
By model
How each model treated ZeroFox across every prompt where it was named for a mid-market B2B company. Fourteen models, six prompts per category.ShowHide
By model
| Model | First choice | Alternative | Mention | Negative | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 2 | 0 | 0 | 2 |
| GPT-5.4 mini | 3 | 0 | 1 | 1 | 5 |
| Gemini 3.5 Flash | 1 | 2 | 0 | 1 | 4 |
| Perplexity Sonar | 0 | 1 | 2 | 0 | 3 |
| Grok 4.20 | 3 | 1 | 0 | 1 | 5 |
| Mistral Small | 1 | 0 | 1 | 1 | 3 |
| DeepSeek V4 Flash | 1 | 3 | 0 | 2 | 6 |
| Llama 4 Maverick | 0 | 0 | 1 | 0 | 1 |
| Qwen 3.7 Flash | 2 | 0 | 0 | 1 | 3 |
| Kimi K2 | 0 | 3 | 0 | 1 | 4 |
| GLM 4.7 FlashX | 0 | 1 | 0 | 1 | 2 |
| MiniMax M2.5 | 1 | 1 | 1 | 1 | 4 |
| GPT-6 Luna | 1 | 1 | 0 | 0 | 2 |
| Muse Glimmer 30B | 0 | 2 | 1 | 1 | 4 |
By framing
What the models said for it
Verbatim evidence the judge attached to positive labels.
“Broad external-threat coverage spanning brand and domain abuse, social platforms, executive risks... Look closely at ZeroFox.” GPT-6 Luna · DRP · comparative prompt · first choice
“If brand, executive, and social media protection with rapid takedowns are your top priorities → ZeroFox” DeepSeek V4 Flash · DRP · comparative prompt · first choice
“ZeroFox is highly regarded for its automated threat intelligence, brand defense, and executive protection.” Gemini 3.5 Flash · DRP · comparative prompt · first choice
“Zerofox (Best Overall for Brand Protection) ... widely considered the gold standard for brand protection” Qwen 3.7 Flash · DRP · paraphrase prompt · first choice
And against it
Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.
“Users frequently report problems with inefficient alerts, slow performance ... and a high volume of false positives.” Mistral Small · DRP · negative prompt · hard negative
“What to avoid (If budget is truly limited):- ZeroFox: Median contract value is ~$45,000/year.” DeepSeek V4 Flash · DRP · budget prompt · hard negative
“ZeroFox – Multiple User Complaints - False positive overload” Kimi K2 · DRP · negative prompt · hard negative
“G2 reviews flag inefficient alerts, high false positives, slow/incomplete takedowns, and time wasted on manual triage” Grok 4.20 · DRP · negative prompt · soft negative
Named alongside
The products named in the same answers as ZeroFox, over the 136 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and ZeroFox was named but was not.ShowHide
Named alongside
What carried it into the answer
Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 130 of the 136 answers that named ZeroFox and are not a share of its labels.
Domains cited
549 of the 595 domain citations in answers naming ZeroFox came from somebody else's page.
Pages cited
Pages are listed as the models cited them.
Search and answers
zerofox.com ranks first on Google for the category's searches. In the answers, ZeroFox takes 14% of first choices and UpGuard BreachSight takes 22%.ShowHide
Search and answers
In search
Google, US estimates- Searches for its name, Google
- 4,400 a month (“zerofox”)
- AI search demand for its name, est.
- 129 a month
- Organic visits to its site
- about 10,937 a month
- Searches its site ranks for
- 2,622 · 139 in the top three
- Sites linking to it
- 3,510
- Paid Google search
- 3 searches its ads show for, about 5 clicks and $175 a month (estimate)
In answers
This edition- First choices
- 23 across its categories
- Named in
- 136 answers
- Its own site cited
- in 130 of the answers that named it
Search figures are US estimates from DataForSEO, read September 28, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.
What it publishes
ShowHide
What it publishes
ShowHide| Kind | Pages | Last 90 days | 2025-10 to 2026-09 | Latest | Categories named |
|---|---|---|---|---|---|
| Blog | 642 | 14 | 2026-09-23 | ASM, MFA | |
| News or press | 128 | undated | ASM | ||
| Glossary or explainer | 105 | undated | ASM, MFA | ||
| Report or ebook | 78 | undated | ASM | ||
| Comparison | 28 | 2 | 2026-09-16 | ||
| Conference or event | 24 | undated | |||
| Podcast or video | 13 | undated | ASM | ||
| Webinar or virtual event | 11 | undated | |||
| Case study | 9 | undated | |||
| Template or tool | 1 | undated | ASM |
Most recent
- 2026-09-23Understanding verification checkmarks blog
- 2026-09-22Sandbox verdict blog
- 2026-09-16Zerofox vs doppel comparing two approaches to takedown and disruption comparison
- 2026-09-11Zerofox alternatives comparison
- 2026-09-10Brand monitoring and enforcement why ai alone isnt enough blog
- 2026-09-08Interview with a phisher blog
Events in person
- September 24, 2026the second summitWashington, D.C.
As the event pages on zerofox.com state them, read September 28, 2026.
How it is countedHide how it is counted
Every page zerofox.com exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. Of its titles that name a category, most name ASM (15); 0 name its categories the models place it in. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.
Names read as ZeroFox
Follow ZeroFox
An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.
Already following? Everything you follow, with a stop for each.
The company
ZeroFox is its own company.ShowHide
The company
In its own words
Stated by the vendor, not checked- Positioning
- Digital Risk Protection platform built for enterprises
- For
- enterprises
- Price stated
- ZeroFox pricing scales to fit your organization’s needs. Find customized cybersecurity packages to safeguard your brand, domains, executives, and attack surface. zerofox.com/pricing
- Certifications
- Certified Security Analyst - Virtual TrainingCertified Security Analyst - Onsite Training
- Not stated on the pages read
- Starting price, free plan or trial, integrations, hosting, customers
What ZeroFox's own pages state, read September 28, 2026: zerofox.com, zerofox.com/pricing, trust.zerofox.com, zerofox.com/platform, zerofox.com/partners. A claimed page can correct any of them.
Claim this page
Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when ZeroFox's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as ZeroFox, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.
What a new claim receivesHide what a new claim receives
A new claim receives the current edition's vendor brief for ZeroFox by email, built from the raw record of the edition. It shows:
- where ZeroFox is named, by buyer and by framing, and which cells hold its first choices;
- the claims the models make when they name it, ranked, with the strongest and the weakest quoted;
- its vocabulary against the segment leader's, and the pages the models cited;
- who was chosen in the answers that did not name ZeroFox, and every reason the record gives;
- a battlecard for each top rival: the head-to-head split, why they win, and the reservation quoted against them;
- one page of published figures cleared to show a buyer.
Badges
Wins only: a badge exists where ZeroFox is ranked in a category's top three this edition. Three sizes, one file each, light and dark; the code is under each.ShowHide
Badges
ZeroFox is among the products AI models recommend first in Digital risk protection this edition. Each badge says so in the buyer's words, names the edition, and links to the standing. The next edition issues a new badge; this one stays true as a record of October 2026.
Badges read on light and dark pages. Alt text carries the claim, the category, the edition and the index, so it stays a citation where the image does not load.