Kiteworks Acquires Bonfy.AI to Enable Runtime Data Governance Across People, Machines, and AI Agents
What Happened — Kiteworks announced the acquisition of Bonfy.AI, a startup that provides AI‑driven, context‑aware classification and policy enforcement at the moment data is exchanged. The combined solution extends Kiteworks’ control plane to govern data in motion for email, file sharing, APIs, and autonomous agents.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs aim to demonstrate that sensitive data is protected both at rest and while in use; runtime governance supplies the evidentiary hook for that requirement.
- A single policy model that spans human users, machines, and AI agents reduces reliance on post‑event alerts and provides a defensible audit trail of enforcement decisions.
- Mapping this capability to the VCF control objective “Data Classification and Enforcement at Point of Use” satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001) with one control implementation.
Who Is Affected – Enterprises that exchange regulated or confidential data via email, collaboration tools, APIs, or AI‑enabled services; particularly SaaS providers, financial services, healthcare, and any organization subject to data‑privacy regulations.
Recommended Actions
- Review your current data‑at‑rest classification program and identify gaps where data in motion is not covered.
- Map the new runtime governance control to your audit‑readiness evidence collection (policy decision logs, enforcement outcomes).
- Pilot the Kiteworks‑Bonfy.AI control plane on a high‑risk data flow to validate policy effectiveness and evidence generation.
Source: Help Net Security
Technical Notes – The solution leverages AI to evaluate context (sender, recipient, relationship, channel, business purpose) and enforces policy before the exchange completes. It operates across email, file sharing, APIs, and AI agents, delivering a real‑time allow/deny decision rather than a retrospective alert. Source: same article