Kiteworks, which helps organizations manage risk across every send, share, receive, and use of private data, today announced the acquisition of Bonfy.AI, an AI data security company specializing in real-time, inline classification and policy enforcement for sensitive data across email, file sharing, SaaS applications, data repositories, Internet-facing AI assistants, and autonomous agents.
The acquisition strengthens runtime data governance within the Kiteworks control plane and expands policy enforcement across enterprise data exchanges. It enables organizations to govern exchanges at the point they occur, regardless of whether the actor is a human, machine, or autonomous AI agent.
The deal addresses a fundamental gap in enterprise data protection. Over the past decade, organizations have invested heavily in data discovery and posture management to identify and catalog sensitive information stored across their data environments. Kiteworks now extends those capabilities by governing sensitive data as it moves into and through third-party ecosystems. While posture management focuses on data at rest, risk emerges when data is in motion—for example, when an employee is preparing to send an email, attach a file, or when an AI agent is preparing a response.
Bonfy.AI technology enables Kiteworks to address this gap by shifting data classification and policy enforcement directly to the point of exchange. The technology evaluates information alongside the context of the transaction, including the sender, recipient, counterparty relationship, communication channel, and business purpose, before applying policy prior to completion of the exchange.
Integrated into the Kiteworks control plane for secure data exchange, the combined capabilities provide a unified approach to governing data in motion and in use. A single policy model can be applied consistently across people, machines, and systems throughout the enterprise.
“Bonfy.AI’s cutting-edge technology expands our coverage and capability to deliver the control our customers need in the AI era, and its excellent team will further accelerate the development of our unified Data Control Plane,” said Amit Toren, Chief Business Officer, Kiteworks. “We have built Kiteworks through a rare combination of in-house innovation, operational excellence, and disciplined M&A, with eight acquisitions in under five years, each one expanding our ability to deliver the most comprehensive data security and compliance platform available in the market.”
Strategic value of the acquisition
- Runtime policy decisions rather than retrospective reporting. Policies are assessed and enforced inline as an exchange occurs across email, file sharing, APIs, and AI agents, generating an actionable decision rather than simply an alert.
- Context-aware analysis beyond pattern matching. Entity-aware analysis determines the meaning and risk of data based on the specific relationship and destination involved. This can reduce the false-positive burden associated with traditional prevention technologies, where approximately half of alerts may ultimately be benign.
- A unified policy model across AI and human workflows. The same controls governing an employee who sends an attachment can also govern an AI agent that retrieves, generates, or transmits data, helping address security gaps created when AI systems act on behalf of users.
- Enterprise-wide control of data exchanges across repositories and systems of record. Sensitive data exchanged through systems including Outlook, Gmail, OneDrive, SharePoint, Workspace, and Salesforce can be governed through the Kiteworks control plane regardless of where the information is stored at rest, allowing end users to maintain their (compliant) business-as-usual operations.
- Auditable compliance at the point of enforcement. Classification and policy enforcement actions are recorded as evidence that can be audited. Regulations and frameworks including CMMC 2.0, HIPAA, and GDPR require organizations to demonstrate effective controls rather than simply maintain an inventory of sensitive data.
- Extension of existing data-layer governance. The capability builds on the Kiteworks Data Policy Engine and Compliant AI rather than operating as a separate product, reinforcing the role of the data layer as a durable control point.
“Everything we build comes back to a single promise to our customers: you stay in control of your private data, everywhere it moves and everywhere it is used,” said Tim Freestone, Chief Strategy Officer, Kiteworks. “Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives was part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we’re closing.”
“We built Bonfy.AI around a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes,” said Gidi Cohen, CEO and Founder of Bonfy.AI. “Kiteworks gives that technology a control plane and a reach we could not have built on our own. I’m excited to see it governing data for both people and AI agents at global scale.”
______
About Bonfy.AI
Bonfy.AI delivers AI data security for content workflows, protecting sensitive data at every point it enters, moves through, or exits an AI system. The platform applies input control, output control, and contextual data enforcement across enterprise AI deployments, including Microsoft 365 Copilot, Claude, ChatGPT, and custom agentic workflows, as well as email, SaaS applications, and cloud data stores. Adaptive knowledge graphs learn organizational structure, business relationships, and policies from CRM, IAM, and HRIS integrations, delivering entity-aware, contextual enforcement without new toolsets or infrastructure overhead.
About Kiteworks
Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive, and use of private data. The Kiteworks platform provides customers with a secure data exchange that delivers data governance, compliance, and protection in a unified control plane. Kiteworks unifies, tracks, controls, and secures sensitive data moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all private data exchanges. Headquartered in Silicon Valley, Kiteworks protects over 100 million end-users and thousands of global enterprises and government agencies.
Media Contact
David Schutzman
PR Manager, Kiteworks
david.schutzman@kiteworks.com
Join our LinkedIn group Information Security Community!
