Kiteworks buys Bonfy.AI to move data classification into the send path

Bonfy.AI's control sits in the send path. It evaluates an exchange using the sender, the recipient, the counterparty relationship, the channel and the business purpose of the transfer, then applies policy before the send completes ^[2]. Kiteworks says the result is a decision made at runtime across email, file sharing, APIs and AI agents, not a report after the fact ^[3].

That thesis is what got bought. Bonfy.AI chief executive Gidi Cohen said the company was built around "a single idea: risk is created when data moves, not when it sits, and controlling it means reading the full context of an exchange at runtime, before it completes" ^[13].

Kiteworks wrote the accuracy problem into its own case for the deal. Entity-aware analysis, it says, "materially reduces the false positive burden that has limited traditional prevention tooling, where roughly half of alerts prove benign" ^[8]. No source is given for the half. Neither account carries an accuracy figure, a false-positive rate or a latency number for Bonfy.AI, and inline evaluation has to finish before a send completes ^[22].

The price is not disclosed. SecurityWeek reports CTech estimating it at tens of millions of dollars ^[4]. Bonfy was founded in early 2024 by Cohen and Danny Kibel ^[5] and emerged from stealth in June 2025 with $9.5 million in seed funding ^[6]. Help Net Security dated its report 11 September 2026 ^[18]. That is 15 months from the stealth exit to the acquisition ^[19], and roughly 32 months from founding ^[20].

Kiteworks calls this its eighth acquisition in under five years ^[7]. Eight inside 60 months averages one every 7.5 months, and the stated span is shorter than that ^[21]. Both published accounts of the deal carry the same three executive quotes and the same six-point list of strategic value ^[16]. The material in either piece that does not come from the announcement is CTech's price estimate and Bonfy's founding and funding history ^[23].

"Inline at runtime classification is what makes that promise complete. Knowing where sensitive data lives is part of the equation, but deciding, in the instant data leaves, whether it should leave, and being able to prove that decision to a regulator months later is a big gap we're closing," Kiteworks chief strategy officer Tim Freestone said ^[14].

What the sources show is one vendor relocating its own control point. Neither shows a customer moving budget out of discovery and posture tooling, and neither gives an availability date or a price for the combined capability ^[22].