Kiteworks has acquired Bonfy.AI, an AI data security company focused on classifying and enforcing policies on sensitive data in real time and inline across email, file sharing, SaaS applications, data repositories, Internet-facing AI assistants and autonomous agents.

The acquisition extends runtime data governance within the Kiteworks control plane, allowing organizations to govern data exchanges at the point they occur across people, machines and autonomous agents.

According to Kiteworks, enterprises have spent years building inventories of sensitive data through data discovery and posture management tools. However, the company said those capabilities primarily address data at rest while risk can emerge when sensitive data moves through channels such as email, file sharing and AI-generated responses.

Bonfy.AI technology moves classification and enforcement to the point of exchange. The platform evaluates data alongside contextual factors including the sender, recipient, counterparty relationship, channel and business purpose before applying policy.

The combined capabilities are delivered through the Kiteworks control plane and use a single policy model to govern data in motion and in use across enterprise systems.

“Bonfy.AI’s cutting-edge technology expands our coverage and capability to deliver the control our customers need in the AI era, and its excellent team will further accelerate the development of our unified Data Control Plane,” said Amit Toren, Chief Business Officer, Kiteworks. “We have built Kiteworks through a rare combination of in-house innovation, operational excellence, and disciplined M&A, with eight acquisitions in under five years, each one expanding our ability to deliver the most comprehensive data security and compliance platform available in the market.”

Kiteworks said the acquisition enables policy decisions to be evaluated and applied inline at runtime across email, file sharing, APIs and AI agents rather than producing alerts after an exchange has occurred.

The technology also uses entity-aware analysis to interpret data based on the relationship and destination involved in an exchange. Kiteworks said this approach can reduce false positives associated with traditional prevention tools.

The company also said the same policy model can govern both human and AI workflows. For example, controls applied when a person sends an attachment can also govern an AI agent retrieving, generating and transmitting data.

The technology extends governance across data exchanged through systems including Outlook, Gmail, OneDrive, SharePoint, Workspace and Salesforce regardless of where the data resides at rest. Kiteworks said classification and enforcement actions are also captured as auditable evidence to support compliance requirements.

“Everything we build comes back to a single promise to our customers: you stay in control of your private data, everywhere it moves and everywhere it is used,” said Tim Freestone, Chief Strategy Officer, Kiteworks. “Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives was part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we’re closing.”

The acquisition builds on the Kiteworks Data Policy Engine and Compliant AI capabilities rather than creating a separate product, according to the company.

“We built Bonfy.AI around a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes,” said Gidi Cohen, CEO and Founder of Bonfy.AI. “Kiteworks gives that technology a control plane and a reach we could not have built on our own. I’m excited to see it governing data for both people and AI agents at global scale.”