What are some examples of On-Demand Investigations?

The ZeroFox Threat Research Team will work to understand your intelligence requirements. They produce deep-dive reports, threat assessments, research projects, and ad hoc analytic projects – all completely tailored to your organization. Some examples are: Executive Threat Assessments: Assesses VIP entities and their related assets to identify risks, vulnerabilities, and malicious exploitation based on their digital footprints. Includes targeted recommendations and a sample spear phish to identify digital and physical risks. Travel Assessments: Provides security intelligence detailing physical, cyber, and geopolitical risks associated with travel to a designated geographic region, country, or location of interest, along with recommendations and best practices. Person of Interest Investigations: Investigates internal or external subjects with an intent to establish identity, determine motivation, and assess reputation to help inform the level of risk and appropriate course of action. Background Check Investigations: Profiles potential risks and threats posed by a prospective employee or candidate, as identified in the open source and social media sources. Attack Surface Assessments: Gauges the company’s cybersecurity posture across several categories of risk. Supply Chain & Third Party Risk Assessments: Evaluates a company’s posture focused on cyber, reputational, and regulatory vulnerabilities and risks. Industry & Regional Threat Landscapes: Focused on region- or industry-specific cyber threat trends or geopolitical issues of strategic importance, this report provides an extensive review of risks and threats of interest and highlights impacts on business operations and continuity.

Dedicated Threat Intelligence Analyst

Reactive Intelligence Arrives Too Late

By the time threats hit open forums or mainstream platforms, the damage has often started. You need early warning from hard-to-reach sources, validated by experts who can explain what it means and what to do next. Get proactive with ZeroFox Managed Intelligence Services.

of organizations do not have documented intelligence requirements ¹

of organizations report difficulties retaining qualified cybersecurity professionalss ²

of security leaders indicate a lack of skills expertise is the #1 challenge with Threat Intelligence ³

Expand CTI and SOC Teams

Access to dedicated analysts who become part of your operations team.

Confirm Post-Breach Exposure

Separate Signal from Noise

Credential and Dataset Acquisition and Validation

On-Demand Investigations

dark web forums continuously monitored

years delivering on-demand intelligence to our customers

posts collected per month from dark web sources

Transform raw signals into finished intelligence that drives action, including validation, context, and tailored recommendations aligned to your priorities.

The ZeroFox Threat Research Team will work to understand your intelligence requirements. They produce deep-dive reports, threat assessments, research projects, and ad hoc analytic projects – all completely tailored to your organization. Some examples are:

Executive Threat Assessments: Assesses VIP entities and their related assets to identify risks, vulnerabilities, and malicious exploitation based on their digital footprints. Includes targeted recommendations and a sample spear phish to identify digital and physical risks.
Travel Assessments: Provides security intelligence detailing physical, cyber, and geopolitical risks associated with travel to a designated geographic region, country, or location of interest, along with recommendations and best practices. Person of Interest Investigations: Investigates internal or external subjects with an intent to establish identity, determine motivation, and assess reputation to help inform the level of risk and appropriate course of action.
Background Check Investigations: Profiles potential risks and threats posed by a prospective employee or candidate, as identified in the open source and social media sources.
Attack Surface Assessments: Gauges the company's cybersecurity posture across several categories of risk. Supply Chain & Third Party Risk Assessments: Evaluates a company's posture focused on cyber, reputational, and regulatory vulnerabilities and risks.
Industry & Regional Threat Landscapes: Focused on region- or industry-specific cyber threat trends or geopolitical issues of strategic importance, this report provides an extensive review of risks and threats of interest and highlights impacts on business operations and continuity.

The easiest and fastest way to request an On-Demand Investigation is by using the Request for Information (RFI) form in the ZeroFox platform. This feature offers a secure in-platform mechanism for two-way communication directly with ZeroFox's Intelligence analysts. Through the RFI feature, your organization can use On-Demand Investigation (ODI) credits to receive answers to intelligence requirements or gain additional context around findings. If you’re not yet a ZeroFox customer, you can reach out to us here.

Intelligence collection, analysis, and review will be conducted in English. Specific linguist support/language skills can be supported at an additional cost, for up to 20 languages.

ZeroFox Threat Intelligence Analysts take identified security risks and threats to your systems, facilities, business operations, and people and map them to Standing Intelligence Requirements (SIRs) and to your Priority Intelligence Requirements (PIRs) for seamless ingestion and actioning by your security teams. You may request assistance as-needed with On-Demand Investigations or add a full-time intelligence analyst to your team with our Dedicated Analysts service.

OnWatch Expert is a dedicated intelligence analyst embedded in your team to deliver analysis, reporting, and escalation support.

SOC/CTI teams that need added capacity, consistent coverage, and expert context without additional headcount.

DarkOps Managed Services provide breach-driven, human-led deep & dark web monitoring and intelligence operations that help customers quickly confirm exposure, understand threat actor intent, and take informed action—during the critical weeks after an incident. Unlike automated “dark web alerts,” DarkOps delivers human-curated Key Incidents, acquisition of relevant data when needed, and analyst-led validation + context from sources that are closed, exclusive, and inaccessible to standard collection methods.

Organizations with staffing constraints, high alert volume, global coverage needs, or urgent investigative requirements.

Expert Intelligence Services

Reactive Intelligence Arrives Too Late

Running an effective intelligence program is challenging

ZeroFox Expert Intelligence Services

The ZeroFox Advantage

Why ZeroFox Leads in Expert Intelligence Services

AI + human tradecraft

Access to the hardest sources

Validated, contextualized findings

Digital-to-physical correlation

Continuous Program Tuning

Executive-ready Briefings

Expert Intelligence Services Key Functionality

2026 Key Forecasts Report

Resources

Frequently asked questions