Kiteworks Acquires Bonfy.AI to Deliver Enterprise-Wide Runtime Data Classification and Policy Enforcement

Acquisition augments the Kiteworks Data Control Plane with AI-native runtime data classification and connectors to data repositories and systems of record, extending Kiteworks policy enforcement across agent and human data exchange and use.

Kiteworks, which empowers organizations to effectively manage risk in every send, share, receive, and use of private data, today announced it has acquired Bonfy.AI, an AI data security company whose platform classifies and enforces policies on sensitive data in real time and inline across email, file sharing, SaaS applications, data repositories, Internet-facing AI assistants, and autonomous agents. The acquisition extends runtime data governance in the Kiteworks control plane across the enterprise, turning every exchange into a governed decision made at the moment it happens, whether the actor is a person, a machine, or an autonomous agent.

The acquisition addresses a structural gap in how enterprises protect sensitive data. Enterprises have invested a decade in data discovery and posture management, building detailed inventories of the sensitive data that sits inside their data stores. With this acquisition, Kiteworks complements that value by governing that same sensitive data as it is exchanged into the third-party ecosystem. Posture management classifies data at rest. Risk is created in motion: in the email a person is about to send, in the file that is about to be attached, in the response an agent is about to generate.

With Bonfy.AI technology, Kiteworks closes that gap by moving classification and enforcement to the point of exchange. Bonfy.AI evaluates data with the context around it, including the sender, the recipient, the counterparty relationship, the channel, and the business purpose of the exchange, then applies policy before the send completes. Delivered inside the Kiteworks control plane for secure data exchange, the combined capability governs data in motion and in use through a single policy model that applies equally to people, machines, and systems across any system in the enterprise. Kiteworks will continue to offer Bonfy.AI to customers as a separate solution while it is integrated into the Kiteworks platform.

“Bonfy.AI’s cutting-edge technology expands our coverage and capability to deliver the control our customers need in the AI era, and its excellent team will further accelerate the development of our unified Data Control Plane,” said Amit Toren, Chief Business Officer, Kiteworks. “We have built Kiteworks through a rare combination of in-house innovation, operational excellence, and disciplined M&A, with eight acquisitions in under five years, each one expanding our ability to deliver the most comprehensive data security and compliance platform available in the market.”

Strategic value of the acquisition

• A governed decision inline at runtime, not just a report after the fact. Policy is evaluated and applied at the moment of the exchange, across email, file sharing, APIs, and AI agents, producing a decision rather than just an alert.
• Context instead of pattern matching. Entity-aware analysis interprets what data means to a specific relationship and destination, which materially reduces the false positive burden that has limited traditional prevention tooling, where roughly half of alerts prove benign.
• One policy model for AI and human workflows. The same controls that govern a person sending an attachment govern an agent retrieving, generating, and transmitting data, closing the gap that opens when AI systems act on behalf of human users.
• Enterprise-wide data exchange control from popular data repositories and systems of record. Sensitive data exchanged via systems like Outlook, Gmail, OneDrive, SharePoint, Workspace, and Salesforce is governed by the Kiteworks control plane regardless of where that data resides at rest, so the end users maintain their (compliant) business-as-usual operations.
• Provable compliance at the moment of decision. Every classification and enforcement action is captured as auditable evidence. CMMC 2.0, HIPAA, GDPR, and others require that organizations demonstrate control, not merely produce an inventory.
• An extension of data-layer governance, not a parallel product. The capability builds directly on the Kiteworks Data Policy Engine and Compliant AI, reinforcing the position that the data layer is the only durable control point.

“Everything we build comes back to a single promise to our customers: you stay in control of your private data, everywhere it moves and everywhere it is used,” said Tim Freestone, Chief Strategy Officer, Kiteworks. “Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives was part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we’re closing.”

“We built Bonfy.AI around a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes,” said Gidi Cohen, CEO and Founder of Bonfy.AI. “Kiteworks gives that technology a control plane and a reach we could not have built on our own. I’m excited to see it governing data for both people and AI agents at global scale.”

About Bonfy.AI

Bonfy.AI delivers AI data security for content workflows, protecting sensitive data at every point it enters, moves through, or exits an AI system. The platform applies input control, output control, and contextual data enforcement across enterprise AI deployments, including Microsoft 365 Copilot, Claude, ChatGPT, and custom agentic workflows, as well as email, SaaS applications, and cloud data stores. Adaptive knowledge graphs learn organizational structure, business relationships, and policies from CRM, IAM, and HRIS integrations, delivering entity-aware, contextual enforcement without new toolsets or infrastructure overhead.

About Kiteworks

Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive, and use of private data. The Kiteworks platform provides customers with a secure data exchange that delivers data governance, compliance, and protection in a unified control plane. Kiteworks unifies, tracks, controls, and secures sensitive data moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all private data exchanges. Headquartered in Silicon Valley, Kiteworks protects over 100 million end-users and thousands of global enterprises and government agencies.