Summary
- Kiteworks acquired Bonfy.AI on 8 September; financial terms were not disclosed.
- Bonfy.AI applies classification and policy controls as information moves through email, SaaS, repositories, and AI workflows.
- Kiteworks plans to integrate the technology into its Data Control Plane while continuing to offer Bonfy.AI separately during the transition.
Kiteworks has acquired AI data-security company Bonfy.AI, extending its data-control platform into real-time classification and policy enforcement for information moving between employees, business applications, and autonomous AI agents.
The transaction was announced by Kiteworks on 8 September, despite supplied UK publicity carrying a 10 September date. Financial terms were not disclosed.
Bonfy.AI’s technology evaluates information at the point it is exchanged rather than relying only on inventories of data stored in repositories. Kiteworks says the system can apply controls across email, file sharing, SaaS applications, cloud data stores, public AI assistants, and agentic workflows.
The acquisition reflects a change in the security problem created by enterprise AI. Traditional data-loss prevention and data-security posture management systems have largely been designed around employees, devices, applications, and stored information. Autonomous agents add software identities capable of retrieving, combining, generating, and transmitting data without a human initiating each individual step.
That creates a policy question at runtime. An agent may have legitimate access to a customer record and legitimate access to an external service while still creating an unacceptable disclosure when it combines the two in a particular workflow.
Kiteworks says Bonfy.AI evaluates contextual information including sender, recipient, relationship, channel, and business purpose before an exchange completes. It plans to incorporate that capability into its Data Control Plane so the same policy model can govern human and machine activity.
Those are vendor descriptions of intended functionality. The acquisition does not itself establish how accurately the combined platform will classify information, how much operational friction inline enforcement will introduce, or how consistently policies can be applied across different enterprise applications.
The architectural direction is nevertheless notable. Many organisations have approached AI governance by controlling which models employees may use. That addresses one layer of risk but becomes less effective as AI functionality is embedded inside business software and agents interact directly through APIs.
At that point, controlling the movement and use of the data may be more durable than trying to classify every application as either approved or prohibited. Policies can theoretically follow categories of information even as the service processing them changes.
That approach also intersects with European data-protection and governance requirements. GDPR does not create a special exemption for AI-mediated processing, while sector rules can require organisations to demonstrate where regulated information is sent and under what controls. An automated agent can therefore create the same compliance consequences as a human user, even when its actions occur much faster.
Auditability is another part of Kiteworks’ acquisition rationale. The company says classification and enforcement decisions can be recorded as evidence of how a policy was applied at the moment of exchange.
Kiteworks has pursued an active acquisition strategy, with Bonfy.AI becoming its eighth acquisition in less than five years. The company said it will continue offering Bonfy.AI separately while integrating the technology.
The longer-term challenge will be whether runtime controls can keep pace with increasingly autonomous workflows without reducing them to rigid approval gates. Agents derive much of their value from acting across applications with limited intervention. Governance systems must therefore distinguish legitimate automation from risky data movement quickly enough not to eliminate that advantage.
The Bonfy.AI deal places that problem at the centre of Kiteworks’ platform strategy: not simply discovering sensitive data, but deciding whether a person or software agent should be allowed to move it before the exchange occurs.
