Kiteworks has acquired Bonfy.AI, extending runtime data governance across its control plane. The acquisition enables organizations to govern data exchanges as they happen, whether initiated by a person, machine, or autonomous agent.
The acquisition addresses a structural gap in how enterprises protect sensitive data. Enterprises have invested a decade in data discovery and posture management, building detailed inventories of the sensitive data that sits inside their data stores. With this acquisition, Kiteworks complements that value by governing that same sensitive data as it is exchanged into the third-party ecosystem. Posture management classifies data at rest. Risk is created in motion: in the email a person is about to send, in the file that is about to be attached, in the response an agent is about to generate.
With Bonfy.AI technology, Kiteworks closes that gap by moving classification and enforcement to the point of exchange. Bonfy.AI evaluates data with the context around it, including the sender, the recipient, the counterparty relationship, the channel, and the business purpose of the exchange, then applies policy before the send completes. Delivered inside the Kiteworks control plane for secure data exchange, the combined capability governs data in motion and in use through a single policy model that applies equally to people, machines, and systems across any system in the enterprise.
“Bonfy.AI’s cutting-edge technology expands our coverage and capability to deliver the control our customers need in the AI era, and its excellent team will further accelerate the development of our unified Data Control Plane,” says Amit Toren, Chief Business Officer, Kiteworks. “We have built this company through a rare combination of in-house innovation, operational excellence, and disciplined M&A, with eight acquisitions in under five years, each one expanding our ability to deliver the most comprehensive data security and compliance platform available in the market.”
Strategic value of the acquisition
- A governed decision inline at runtime, not just a report after the fact. Policy is evaluated and applied at the moment of the exchange, across email, file sharing, APIs, and AI agents, producing a decision rather than just an alert.
- Context instead of pattern matching. Entity-aware analysis interprets what data means to a specific relationship and destination, which materially reduces the false positive burden that has limited traditional prevention tooling, where roughly half of alerts prove benign.
- One policy model for AI and human workflows. The same controls that govern a person sending an attachment govern an agent retrieving, generating, and transmitting data, closing the gap that opens when AI systems act on behalf of human users.
- Enterprise-wide data exchange control from popular data repositories and systems of record. Sensitive data exchanged via systems like Outlook, Gmail, OneDrive, SharePoint, Workspace, and Salesforce is governed by the Kiteworks control plane regardless of where that data resides at rest, so the end users maintain their (compliant) business-as-usual operations.
- Provable compliance at the moment of decision. Every classification and enforcement action is captured as auditable evidence. CMMC 2.0, HIPAA, GDPR, and others require that organisations demonstrate control, not merely produce an inventory.
- An extension of data-layer governance, not a parallel product. The capability builds directly on the Kiteworks Data Policy Engine and Compliant AI, reinforcing the position that the data layer is the only durable control point.
“Everything we build comes back to a single promise to our customers: you stay in control of your private data, everywhere it moves and everywhere it is used,” comments Tim Freestone, Chief Strategy Officer, Kiteworks. “Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives was part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we’re closing.”
“We built Bonfy.AI around a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes,” adds Gidi Cohen, CEO of Bonfy.AI. “Kiteworks gives that technology a control plane and a reach we could not have built on our own. I’m excited to see it governing data for both people and AI agents at global scale.”