Kiteworks buys Bonfy.AI to add runtime data classification

Kiteworks said Sept. 10, 2026, that it acquired Bonfy.AI to extend its data control plane with AI-native runtime classification and policy enforcement across email, file sharing, SaaS apps and AI agents. The deal is designed to close a gap between discovering sensitive data at rest and controlling it as data moves through enterprise systems.

Why it matters: - Kiteworks is trying to shift enterprise data security from static inventories to real-time control at the moment data leaves a system. - The combined platform is meant to govern sensitive data across human workflows, machine workflows and autonomous agents with one policy model. - The move targets a core compliance problem: companies must show they controlled sensitive data, not just cataloged it.

What happened: - Kiteworks announced on Sept. 10, 2026, that it acquired Bonfy.AI. - The acquisition adds AI-native runtime data classification and policy enforcement to the Kiteworks Data Control Plane. - The combined offering is designed to cover email, file sharing, SaaS applications, data repositories, internet-facing AI assistants and autonomous agents. - The acquisition also adds connectors to data repositories and systems of record.

The details: - Bonfy.AI classifies sensitive data inline in real time across email, file sharing, SaaS applications, data repositories, AI assistants and autonomous agents. - Bonfy.AI evaluates context around the exchange, including the sender, recipient, counterparty relationship, channel and business purpose. - Policy is applied before a send completes, so the system produces a decision rather than only an alert. - Kiteworks said the approach extends runtime data governance across the enterprise and makes each exchange a governed decision at the moment it happens. - The capability is delivered inside the Kiteworks control plane for secure data exchange. - The combined system governs data in motion and in use through a single policy model. - Kiteworks said the system works across people, machines and systems. - The platform is meant to govern sensitive data moving through systems such as Outlook, Gmail, OneDrive, SharePoint, Workspace and Salesforce. - Data can remain wherever it sits at rest, while the Kiteworks control plane governs the exchange. - Every classification and enforcement action is captured as auditable evidence. - Kiteworks cited CMMC 2.0, HIPAA and GDPR as examples of regulations that require proof of control. - The capability builds on the Kiteworks Data Policy Engine and Compliant AI. - Kiteworks said the data layer is the durable control point.

Between the lines: - The acquisition fills a gap between data discovery tools that map sensitive information and prevention tools that act when data is about to move. - Kiteworks is betting that context-aware, entity-aware analysis will cut down on false positives, which it said have burdened traditional prevention systems. - The deal also reflects a broader push to apply the same controls to AI agents that already govern employees. - Kiteworks Chief Business Officer Amit Toren said the company has completed eight acquisitions in under five years. - Toren said the Bonfy.AI team will help accelerate development of Kiteworks' unified Data Control Plane. - Kiteworks Chief Strategy Officer Tim Freestone said inline runtime classification closes the gap between knowing where sensitive data lives and deciding whether it should leave. - Bonfy.AI CEO and Founder Gidi Cohen said Kiteworks gives the technology a control plane and reach beyond what Bonfy.AI could build alone.

What's next: - Kiteworks will fold Bonfy.AI technology into its unified Data Control Plane. - The company will keep pushing the platform toward broader control of data used by both people and AI agents at enterprise scale. - The acquisition positions Kiteworks to market a single governance layer for data exchanges across the enterprise.

The bottom line: - Kiteworks is making a clear bet that enterprise data security now has to decide, not just detect, at the exact moment data moves.