Phishing takedown services: in-house, agency, or SaaS?

Ask three vendors how they compare and you'll get three answers, each one unfair to the other two. Brand-protection vendors talk past each other because the category has fractured into three operating models with different unit economics, different SLAs, and very different price points. Buying the wrong model at the right price is the most common procurement mistake mid-market security teams make.

This is an honest comparison from a vendor inside the category. We run OpenBait — a self-serve SaaS in the lower price band — so the bias here is real, but the framework should hold up regardless of where you land. The goal is to help you ask the right questions before you write a PO.

The three operating models

Almost every "phishing takedown" offer falls into one of these:

Enterprise DRP platforms (Memcyco, Bolster, ZeroFox, Axur, Fortra/PhishLabs). Custom-quoted, typically $4K–$30K/month for a mid-market deployment, $100K+/year at the enterprise tier. Multi-channel coverage: domain spoof, social impersonation, dark web, executive protection, sometimes app-store and marketplace. Sales-led procurement with 4–8 week onboarding.

Agency / managed service (smaller specialty firms, MSSPs, regional providers). Hourly or per-incident retainers, typically $1.5K–$8K/month. Heavy human-in-the-loop, slower than software but flexible — they'll handle a UDRP case or talk to a registrar in a language the registrar prefers. Quality varies wildly between firms.

Self-serve SaaS (Phish.Report, OpenBait, a few others). From free to about $500/month: OpenBait has a free plan, and Phish.Report lists a single plan at $500/month (both as of September 2026). With Phish.Report your team drives the submission; on OpenBait's paid plans we file the takedowns, and the Free plan stops at browser blocklist submissions. In both cases the platform automates the boring parts (templated abuse reports, parallel browser blocklist submission, evidence capture). Fastest to start, lowest unit cost, no procurement friction.

The enterprise platforms position themselves against managed services. The managed services position themselves against in-house teams. The self-serve SaaS market is what the other two pretend doesn't exist. None of them are "best" — they solve different problems for different buyers.

Enterprise DRP platforms — what you actually get

Name recognition correlates with marketing spend rather than fit. A few notes from reading each vendor's public material and from cases we have filed ourselves, not from pitch decks:

Memcyco — Agentless real-time visitor identification at the fake site. They have a genuinely novel mechanism: when a visitor lands on the cloned phishing page, Memcyco's beacon (which the attacker copied along with the rest of the HTML) fires, and Memcyco can correlate that visitor session back to the original brand owner's user database. They also offer "decoy credential" injection — replacing harvested credentials with traceable fakes so the brand owner sees account-takeover attempts before they succeed. Strong tech, premium pricing (enterprise-only quote, no self-serve), heavy in financial-services and e-commerce verticals. Memcyco is closest to OpenBait in how it defends the customer side, but it sits in a different price band.

Bolster — AI-led automation at scale. Public claim: 75% of takedowns under 60 seconds, 95% zero-touch automation. Whether your real environment hits those numbers depends heavily on the registrar mix; the easy registrars (Cloudflare, Porkbun, Namecheap with stable abuse contacts) are fast, the hard ones (NameSilo, certain regional registrars) aren't. Their dashboard is genuinely good. Pricing is enterprise-only.

ZeroFox — Strongest in social-channel coverage. They monitor 180+ platforms, including ones that other platforms ignore (regional ones, niche forums). Social impersonation is their strength. Their domain takedown SLA is 15 minutes for the median case, which is slower than Bolster but faster than most. Sales process is heavy.

Axur — Marketplace and counterfeit-product oriented, very strong in LATAM with growing global reach. Best-in-class for brands fighting counterfeit sales on Amazon, Mercado Libre, Alibaba. Domain phishing is a secondary feature, not the core.

Fortra / PhishLabs — The category's old guard, now part of Fortra. Curated threat intelligence with a managed-service feel. They commit to "unlimited mitigation," which sounds infinite but in practice means "we'll keep filing until the case closes." Suits buyers who want a vendor to handle most of the work and have the budget for it.

The honest pattern: enterprise DRP is the right fit when phishing impacts your top-line revenue measurably (financial services, e-commerce, large consumer brands) and you have the procurement infrastructure to absorb a $100K+ purchase. If your security team is two people with a $40K/year tooling budget, this is the wrong layer.

Agency / managed service — when humans matter more than throughput

A specialty agency (typically 10–50 people, often founded by someone from law enforcement or a registrar's abuse team) doesn't try to scale through automation. They hand-write registrar reports for hard targets, file UDRPs when needed, and have personal relationships with the abuse teams at the major registrars. For one-off complex cases — a coordinated multi-domain campaign, a state-level actor impersonating a financial institution — this is sometimes the only model that works.

Where they win:

• UDRP and legal escalation, which platforms can't handle
• Hard registrars — the ones that ignore form submissions but answer when a known reporter calls
• Language and local context — a Japanese-speaking abuse handler talking to a Japanese registrar, or a Brazilian counsel handling .br disputes
• Strategic advisory — "should we go after the host or the registrar first" judgment calls

Where they don't:

• Throughput — 50 cases a month strains a small team
• Speed of routine cases — software fans out abuse reports in seconds; humans don't
• Reproducibility — outcomes depend heavily on which staffer picked up the case
• Audit trail — most agencies still operate on email and shared docs; auditing what got submitted when can be painful

Reasonable retainers run $1,500–$8,000/month. If you have fewer than 10 incidents/month and most are unusual, an agency is often better than enterprise software. If you have 50+ a month and most are routine, software wins on cost per case.

Self-serve SaaS — what's actually in this band

This is the segment that didn't exist in 2020. The economics changed because cert transparency, NRD feeds, browser blocklists, and registrar abuse intake APIs all became publicly accessible — automation became feasible for a small team. A few companies in this band today:

• Phish.Report — A takedown workbench for security teams: detection, a verified abuse-contact database, guided reporting, a shared case timeline, and Slack / TheHive / API integrations. One plan at $500/month with a proof-of-value period instead of a free tier (as of September 2026; it was a free utility when this article was first written).
• OpenBait — Detection (CT log + NRD + dnstwist + branded search), a public report page your customers can paste a fake site into, and takedowns filed under one fixed reporter identity. Free (report page and browser blocklist submissions only), then $299–$899/month with us filing the takedowns. Plans count takedowns (one per fake-site domain), not URLs, and any plan can add one for $199; prices are on the pricing page. We're a smaller player, and we say so. The product is built for mid-market teams that buy without a procurement process.
• A few regional / niche players — typically focused on one geography or one channel (social-only, domain-only, etc.)

The trade-off in this band: you're in the loop. Decisions about which cases to escalate, when to invoke a lawyer, what tone to take in your customer comms — none of that gets outsourced. The platform compresses the deterministic work; you still own the judgment.

This works well when:

• Your incident volume is 10–80 per month
• Your team is technical enough to read a screenshot comparison and decide what to do with it
• You want public, predictable pricing
• You can absorb 2–6 hours/week of operator time

It works poorly when:

• You have no security team and want a vendor to "just handle it"
• You need 24/7 SOC coverage
• You have UDRP cases regularly

Concrete decision framework

Skip the vendor demo until you've answered three questions for yourself:

1. What's your incident volume? 1–3 a month → OpenBait Pro (three takedowns a month), or handle them in-house. 4–10 a month → OpenBait Business (ten a month); go past a plan's limit and each extra takedown is $199. More than 10 and up to 80 a month → mid-tier SaaS or boutique agency. 80+ a month with non-trivial UDRP/legal volume → enterprise platform.

2. What's your team capacity? Two-person security team, no SOC → managed service, or a SaaS tool you run hands-on. Five-person team with rotation, established CSIRT process → SaaS scales further. SOC plus dedicated brand protection function → the enterprise platform's full feature set will actually get used.

3. What's the budget honestly available? Below $50K/year → SaaS or hybrid (SaaS for routine + agency on retainer for complex cases). $50K–$150K → mid-tier SaaS plus agency works well, or one of the smaller enterprise platforms. $150K+ → enterprise DRP with full coverage.

The hybrid pattern — SaaS for routine throughput + agency for the 10% of cases that need humans — is the shape that makes sense for a mid-market team that has outgrown pure SaaS but is not ready to commit six figures to an enterprise platform.

Where this breaks for non-English markets

A wrinkle most comparison articles miss: enterprise DRP platforms are uniformly stronger in English-language markets and progressively weaker as you move into JP, KR, regional EU, LATAM, and SEA. The reasons are structural — abuse teams at regional registrars often respond better to communication in the local language; counterfeit takedown on Mercado Libre needs different evidence than on Amazon US; LINE impersonation in Japan needs different platform monitoring than X impersonation does.

If your brand operates predominantly in one non-English market, weight regional fit heavily. A platform with average global features and excellent JP / KR / es-LA coverage often beats a stronger global platform that's weak in your specific market. This is also where boutique agencies retain real advantage — they can hire one person who knows the regional registrar and turn that into a relationship that scales for your specific use case.

Where OpenBait fits

We're a self-serve service built around one thing we have not seen the others offer: a public report page under your own brand, where customers paste the fake site, get an answer in seconds, and we file the reports for you — see how a report becomes a takedown. Plans are public and one brand is free. We do well when:

• Your store or site has been cloned and your customers need a place to report fakes — our site and support are in English, Japanese and Chinese
• You want public pricing and self-serve evaluation, not an enterprise sales cycle
• You're rebuilding your incident-response process and want a platform that documents the workflow, not one that hides it
• Customer reports pile up in a phishing@ mailbox that nobody has time to answer

We do less well when:

• You need 24/7 SOC monitoring
• You routinely escalate to UDRP
• Your brand is a top-50 global financial institution and you need everything that implies

The Free plan gives you 1 brand, a report page for your customers and browser blocklist submissions for confirmed fake sites — enough to test against your own domain. Takedowns to hosting providers and registrars start with Pro, or $199 for a single one. The Memcyco comparison, Axur comparison, and the broader brand-protection SaaS comparison are public, and we list features they have that we don't.

The right answer to "which takedown service should I buy" usually isn't the one in front of the highest-budget brochure. It's the one that matches your incident volume, your team capacity, and your honest budget — and then you upgrade when those constraints change.

---

Related reading

• The first 48 hours of a phishing incident: 7 steps
• How to report a phishing domain to its registrar

Sources

• Gartner Peer Insights — Brand Protection Software
• Bolster public takedown automation claims
• Memcyco product overview
• Fortra PhishLabs Digital Risk Protection
• APWG Phishing Activity Trends Reports