Kiteworks buys Bonfy.AI to move data classification into the send path
Kiteworks' eighth acquisition in under five years puts policy decisions inline on email, file shares and agent traffic. The price is undisclosed, and CTech estimates tens of millions for a startup 15 months out of stealth.
The Watch · Security desk
What happened
- Kiteworks has acquired Bonfy.AI, whose technology classifies data at the moment it is exchanged and applies policy before the transfer completes, including exchanges started by an autonomous agent.
- Kiteworks says this is its eighth acquisition in under five years, all of them feeding what it calls a unified Data Control Plane.
- The combined capability is pitched to govern data exchanged through Outlook, Gmail, OneDrive, SharePoint, Workspace and Salesforce, wherever that data sits at rest.
Why it matters
- What it costs cost A control that decides inside the send path fails loudly: a wrong block stops a legitimate customer email in the moment, and the business absorbs that before any leak is prevented.
- What's now possible capability An agent-initiated exchange has nobody at a keyboard to answer a prompt, so the enforcement point has to decide and record on its own. That is the specific gap Kiteworks says one policy model now covers.
- Who has to decide decision Kiteworks is selling audit evidence as much as prevention. For CMMC 2.0, HIPAA and GDPR work, the log of each classification and enforcement action is the deliverable an assessor can test.
- What it sets up precedent Platform vendors are buying runtime AI data controls instead of shipping their own: SecurityWeek's related coverage lists Palo Alto Networks taking an AI agent platform and Fortinet taking Virtue AI.
Next story · Invest · 2d ago
CrowdStrike falls about 3% on a report of OpenAI talks to buy Trail of BitsConfirmed4 publishers
Bonfy.AI's control sits in the send path. It evaluates an exchange using the sender, the recipient, the counterparty relationship, the channel and the business purpose of the transfer, then applies policy before the send completes [2]. Kiteworks says the result is a decision made at runtime across email, file sharing, APIs and AI agents, not a report after the fact [3].
That thesis is what got bought. Bonfy.AI chief executive Gidi Cohen said the company was built around "a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes" [12].
Kiteworks wrote the accuracy problem into its own case for the deal. Entity-aware analysis, it says, "materially reduces the false positive burden that has limited traditional prevention tooling, where roughly half of alerts prove benign" [23]. No source is given for the half. Neither account carries an accuracy figure, a false-positive rate or a latency number for Bonfy.AI, and inline evaluation has to finish before a send completes [21].
The price is not disclosed. SecurityWeek reports CTech estimating it at tens of millions of dollars [4]. Bonfy was founded in early 2024 by Cohen and Danny Kibel [5] and emerged from stealth in June 2025 with $9.5 million in seed funding [6]. Help Net Security dated its report 11 September 2026 [15]. That is 15 months from the stealth exit to the acquisition [18], and roughly 32 months from founding [19].
Kiteworks calls this its eighth acquisition in under five years [7]. Eight inside 60 months averages one every 7.5 months, and the stated span is shorter than that [20]. Both published accounts of the deal carry the same three executive quotes and the same six-point list of strategic value [17]. The material in either piece that does not come from the announcement is CTech's price estimate and Bonfy's founding and funding history [22].
"Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives is part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we're closing," Kiteworks chief strategy officer Tim Freestone said [13].
What the sources show is one vendor relocating its own control point. Neither shows a customer moving budget out of discovery and posture tooling, and neither gives an availability date or a price for the combined capability [21].
What to watch
- An availability date and a price for inline classification inside the Kiteworks control plane.
- A block rate or false-positive rate measured in a customer deployment and published by someone other than Kiteworks.
- Whether either party or a filing confirms CTech's tens-of-millions estimate.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+35
- Incentives82
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Kiteworks has acquired Bonfy.AI, extending runtime data governance across its control plane, enabling organizations to govern data exchanges as they happen, whether initiated by a person, machine, or autonomous agent.
- [2]
Bonfy.AI evaluates data with the context around it, including the sender, the recipient, the counterparty relationship, the channel, and the business purpose of the exchange, then applies policy before the send completes.
- [3]
Kiteworks says policy is evaluated and applied at the moment of the exchange, across email, file sharing, APIs, and AI agents, producing a decision inline at runtime rather than a report after the fact.
- [4]
The cost of the acquisition has not been disclosed but is estimated by CTech at 'tens of millions of dollars'.
- [5]
Bonfy was founded in early 2024 by Gidi Cohen and Danny Kibel.
- [6]
Bonfy emerged from stealth in June 2025 with $9.5 million in seed funding.
- [7]
Kiteworks says it has made eight acquisitions in under five years, each one expanding its data security and compliance platform, and describes the work as building a unified Data Control Plane.
- [8]
Kiteworks says sensitive data exchanged via systems including Outlook, Gmail, OneDrive, SharePoint, Workspace and Salesforce is governed by the Kiteworks control plane regardless of where that data resides at rest.
- [9]
The Bonfy technology will be used to extend Kiteworks policy enforcement across agent and human data exchange in real time and inline across email, file sharing, SaaS applications, data repositories, Internet-facing AI assistants, and autonomous agents.
- [10]
Kiteworks says every classification and enforcement action is captured as auditable evidence, and that CMMC 2.0, HIPAA, GDPR and others require organisations to demonstrate control, not merely produce an inventory.
- [11]
Kiteworks says the same controls that govern a person sending an attachment govern an agent retrieving, generating, and transmitting data, closing the gap that opens when AI systems act on behalf of human users.
- [12]
"We built Bonfy.AI around a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes," said CEO Cohen.
- [13]
"Everything we build comes back to a single promise to our customers: you stay in control of your private data, everywhere it moves and everywhere it is used. Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives is part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we're closing," comments Tim Freestone, chief strategy officer at Kiteworks.
- [14]
"Bonfy.AI's cutting-edge technology expands our coverage and capability to deliver the control our customers need in the AI era, and its excellent team will further accelerate the development of our unified Data Control Plane," said Amit Toren, chief business officer at Kiteworks.
- [15]
Help Net Security's report on the acquisition is dated 11 September 2026.
- [16]
SecurityWeek's related coverage on the same page lists 'Palo Alto Networks Acquires AI Agent Platform Console' and 'Fortinet Acquires AI Security Company Virtue AI'.
- [17]
Both published accounts of the deal carry the same three executive quotes, from Toren, Freestone and Cohen, and the same six-point list of the acquisition's strategic value.
- [18]
Fifteen months elapsed between Bonfy leaving stealth with seed funding and the acquisition being reported.
- [19]
Roughly 32 months elapsed between Bonfy's founding and the acquisition being reported.
- [20]
Eight acquisitions inside five years is an average of one every 7.5 months, and Kiteworks states the span is under five years, so the actual average interval is shorter.
- [21]
Neither source states an availability date, a price for the combined capability, a customer count, an accuracy or false-positive rate for Bonfy.AI, a latency figure for inline evaluation, or any third-party test of the classification.
- [22]
The only material in either account not drawn from the joint announcement or its executive quotes is CTech's price estimate and Bonfy's founding and funding history.
- [23]
Kiteworks says entity-aware analysis 'materially reduces the false positive burden that has limited traditional prevention tooling, where roughly half of alerts prove benign'.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comKiteworks expands runtime data governance with Bonfy.AI acquisition
1 article · September 11, 2026
- securityweek.comKiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance
1 article · September 11, 2026
Topics and entities
Topics
- AI agent governance
- Compliance evidence and audit trails
- Security mergers and acquisitions
- Data-in-motion security
- Data Loss Prevention