What are the ZeroFox Network and Vulnerability Intelligence Feeds?

ZeroFox’s Network and Vulnerability Intelligence Feeds provide IOCs and IOAs such as IP addresses and malware hashes indicating your organization’s network assets have been compromised. This information helps you keep your infrastructure security controls up to date and understand how to prioritize the mitigation of vulnerabilities.

What are the Covert Communications Intelligence Feeds?

ZeroFox’s Covert Communications Feeds have raw threat data providing you safe access into dark web forums, marketplaces, and covert channels used for selling breached data and planning cyber attacks.

How do the Threat Intelligence Feeds help protect my organization?

The threat data and information in the ZeroFox Threat Intelligence Feeds allows you to discover if your assets, people, or network devices, are at risk. Understanding exposure with contextual data allows you to quickly perform remediation by restricting unauthorized access into accounts and devices.

How do I use the Threat Intelligence Feeds?

Bring the Threat Intelligence Feeds directly into your security stack by way of integration with your SIEM, SOAR, TIP, ITSM, or other tools utilized by your security team. The feeds have flexible filters that allow you to correlate findings or data points in your network to known threats and IOCs. This provides your security team with additional insights that can be used to block IOCs, change passwords, and perform other remediation actions.

New Get the 2025 Key Forecasts Report: The Threats of Today and Their Impact on Tomorrow

Request Demo

Threat Intelligence Feeds

Unique ZeroFox Threat Intelligence, delivered to your platform of choice.

Get a Demo

Stay one step ahead of the attacker

Improve the signal-to-noise ratio with ZeroFox’s Threat Intelligence Feeds, adding exclusive context to expedite decision making and automate protection.

Comprehensive

Extensive data sets deliver all the relevant intelligence to the security team for deep analysis, from unique historical data to the latest dark web research from our embedded operatives.

Accurate

Proprietary intelligence feeds provide unparalleled visibility into malicious infrastructure and exploits to illuminate attacks before they’re launched and prioritize security response.

Timely

Direct machine-to-machine access to raw and regularly updated ZeroFox intelligence delivers easy-to-consume threat data, speeding decisions and automating mitigation when every second counts.

Purpose-built Intelligence Feeds to Defend Against Real-World Threats

Identity & Fraud

Network & Vulnerability

Dark Web Intelligence

Protect Against

Account Compromise
Customer Fraud
PII exposures

What's Included

Botnet (Compromised Credentials)
Phone Numbers
Email Addresses
SSN/NCID
Compromised Credentials
Credit Cards
Breach Info

Integrate With

Active Directory
SSO
IAM
ID Protection
Account Database
Fraud Management

Learn More

How it Works

Each day, billions of pieces of raw intelligence from social media sites, mobile app stores, code shares, and forums (to name a few) are continually analyzed by our platform. Our experts then validate findings and group this intelligence into actionable, context-driven data feeds to enable automated protection from threats, saving you time and resources.

Frequently asked questions

ZeroFox’s Identity and Fraud Intelligence Feeds contain billions of compromised credentials, stolen credit card account numbers, botnet stealer data, breach occurrence descriptions, and other critical information that adds depth to your threat hunting and analytics data lake.

Threat Intelligence Feeds