Kiteworks buys Bonfy.AI to extend real-time data policy enforcement into AI workflows

Kiteworks said Sept. 9 it acquired Bonfy.AI to bring real-time data classification and policy enforcement into data exchange, human workflows and AI agent activity. The deal expands Kiteworks’ control plane across email, file sharing, SaaS apps and autonomous agents as companies tighten governance around sensitive data.

Why it matters: - Kiteworks is extending its security model from protecting stored data to controlling how sensitive data moves and is used in real time. - The acquisition is aimed at closing a gap in enterprise governance as more workers and AI agents generate, move and share sensitive information across systems. - The combined approach is designed to help companies enforce compliance and produce audit evidence at the moment data leaves or moves between systems.

What happened: - Kiteworks announced the acquisition of Bonfy.AI on Sept. 9, 2026. - Bonfy.AI specializes in AI data security and classifies sensitive data in real time directly in the data flow. - The platform applies policies across email, file sharing, SaaS applications, datastores, internet-connected AI assistants and autonomous agents. - Kiteworks said the deal expands its Control Plane into enterprise-wide real-time data governance. - The company said the combined system treats each data exchange as a controlled decision, whether the actor is a person, a machine or an autonomous agent.

The details: - Kiteworks said traditional data discovery and posture management tools mainly classify data at rest, which leaves movement and sharing as the main risk point. - Bonfy.AI evaluates context before an exchange completes, including sender, recipient, relationship to the other party, channel and business purpose. - The policy engine then applies controls before the transfer is finished. - The combined solution covers data in motion and data in use under a single policy model for people, machines and systems. - Kiteworks said the approach works across email, file sharing, APIs and AI agents. - The company said the acquisition reduces false positives by using entity-aware analysis rather than static pattern matching. - Kiteworks said about half of alerts in traditional prevention tools are unfounded. - The solution applies the same controls to a person sending an attachment and to an agent that retrieves, generates and transmits data. - The control plane covers common systems of record and datastores such as Outlook, Gmail, OneDrive, SharePoint, Workspace and Salesforce. - Kiteworks said users can keep normal compliant workflows even when the underlying data is stored elsewhere. - Every classification and enforcement action is logged as audit evidence. - Kiteworks pointed to CMMC 2.0, HIPAA and GDPR as rules that require proof of control, not just an inventory of data. - The functionality builds on Kiteworks Data Policy Engine and Compliant AI. - Bonfy.AI also supports content workflows through input control, output control and context-based data policies for enterprise AI deployments including Microsoft 365 Copilot, Claude and ChatGPT. - Bonfy.AI’s adaptive knowledge graphs learn organizational structure, business relationships and policies from CRM, IAM and HRIS integrations.

Between the lines: - The deal shows how security vendors are shifting from “find and catalog” to “decide and enforce” as AI systems become part of daily enterprise workflows. - Kiteworks is also positioning itself as a broader compliance platform, not just a secure file-transfer or collaboration tool. - Bonfy.AI’s context-aware model could help reduce alert fatigue, which remains a practical barrier to effective data-loss prevention. - Kiteworks is signaling that AI governance and traditional data protection are becoming one control problem rather than separate ones.

What’s next: - Kiteworks said the Bonfy.AI team will help accelerate development of its Data Control Plane. - The company plans to apply the combined controls more broadly across human users, machines and AI agents. - Kiteworks will continue integrating the acquired technology into its security and compliance stack. - Chief Strategy Officer Tim Freestone said the company sees inline real-time classification as fully delivering its promise of data control. - Bonfy.AI founder and CEO Gidi Cohen said the acquisition gives the technology a control plane and scale the startup could not build alone.

The bottom line: - Kiteworks is betting that the future of enterprise data security will depend on controlling each exchange in real time, not just inventorying sensitive data after the fact.