Kiteworks Buys Bonfy.AI to Plug the Gap Between Knowing Where Your Data Is and Actually Controlling It
Kiteworks has acquired AI data security startup Bonfy.AI in a deal estimated at tens of millions of dollars. The terms weren't officially disclosed, but the figure comes from CTech, and nobody's denying it.
Kiteworks builds enterprise content-sharing infrastructure with a heavy focus on compliance, governance, and audit trails. It's the kind of platform that sits at the centre of regulated industries where sensitive data moves constantly and regulators want proof of what happened to it. The problem Kiteworks is trying to solve with this purchase is a frustratingly common one: enterprises know where their sensitive data lives, but that knowledge doesn't automatically translate into control over what happens when someone, or something, actually moves it.
Bonfy.AI was founded in early 2024 by Gidi Cohen and Danny Kibel. It came out of stealth only last month with $9.5 million in seed funding, which makes this a remarkably quick exit. The company built a platform that classifies data at the moment of transfer and enforces security policy before the exchange completes. Crucially, it does this in context, not by pattern-matching for keywords but by reading the full circumstances of the exchange at runtime. That distinction matters enormously when AI agents are involved, because agents don't behave like humans and simple detection rules tend to fall apart fast.
The Bonfy technology will be integrated across the full Kiteworks stack: email, file sharing, SaaS applications, data repositories, internet-facing AI assistants, and autonomous agents. The pitch is a single policy model that applies equally to people, machines, and systems, with enforcement happening inline rather than generating a report after the fact that someone reads three days later.
Kiteworks chief strategy officer Tim Freestone was fairly direct about the gap this fills. Knowing where sensitive data sits is only half the problem. The harder part is making a defensible decision in the moment data leaves a controlled environment, and then being able to demonstrate that decision to a regulator months down the line. That's what inline runtime classification is supposed to deliver.
CEO Cohen framed it similarly. The core idea behind Bonfy was that risk happens when data moves, not when it's sitting still. Kiteworks, he argues, provides the control plane and global reach that a seed-stage startup couldn't build independently.
This is Kiteworks' eighth acquisition in five years. At this point the strategy is fairly legible: buy specialist capability, absorb it into the platform, extend coverage. Bonfy doesn't arrive as a parallel product that gets bundled into a slide deck. It becomes part of the core infrastructure.
With AI agents proliferating across enterprise workflows at a pace that's clearly outrunning most governance frameworks, the timing is convenient. Whether the technology delivers on the promise of genuine contextual enforcement at scale is the question worth watching.