Kiteworks buys Bonfy.AI: DLP moves to agent output

Kiteworks announced on September 8 that it acquired Bonfy.AI, an Israeli startup building runtime data classification — the thing that decides, at the instant data leaves, whether it should. The terms were not disclosed; Calcalist reports an estimate in the tens of millions. The reason this is worth your attention: the scope Kiteworks names includes autonomous agents, and most small companies running agents today have no control at that layer at all.

What actually happened

Bonfy.AI was founded in early 2024 by Gidi Cohen and Danny Kibel and came out of stealth in June 2025 with $9.5 million in seed funding. Its platform classifies and enforces policy inline across email, file sharing, SaaS apps, data repositories, and — the new part — AI assistants and autonomous agents. Per the Kiteworks announcement, it evaluates an exchange in context: sender, recipient, the relationship between them, the channel, and the business purpose, then applies policy before the exchange completes. Coverage listed includes Outlook, Gmail, OneDrive, SharePoint and Salesforce, with every classification and enforcement decision logged for audit.

Kiteworks CEO-side framing from chief strategy officer Tim Freestone: inline runtime classification means "deciding, in the instant data leaves, whether it should leave." Bonfy founder Gidi Cohen puts the thesis more plainly — risk is created when data moves, not when it sits.

That distinction is the whole acquisition. Classic data loss prevention scans repositories and tags files. It assumes the sensitive thing is a file that exists somewhere you can index. An agent that reads three systems and composes a paragraph produces something sensitive that never existed as a file at all.

Why runtime classification matters for your business

Think about what your agents actually do. A support agent reads a ticket, pulls the customer record, checks the order history, and drafts a reply. A sales agent reads the CRM and writes an email. A reporting agent queries the warehouse and posts a summary to Slack.

Every one of those is a composition step, and composition is where leakage happens. The customer record contains a phone number the agent has no reason to repeat. The warehouse query returns margin data that is fine in Looker and not fine in a shared channel. Nothing was exfiltrated, no file moved, and your DLP scanner saw nothing, because the sensitive artifact was assembled in a context window and delivered as text.

You do not need a Kiteworks contract to take this seriously — you need the control in your own stack. Put the output through a check before it reaches the recipient: a redaction pass for the patterns you actually care about (card numbers, SSNs, internal cost fields, customer PII), enforced in code rather than in the prompt. Scope the agent's reads to the columns it needs instead of the whole row; the cheapest way to not leak a field is not to fetch it. Log the full input and output of every agent action to somewhere you can query, because when a customer asks what your AI told someone, "we don't retain that" is a bad answer. And set a human approval gate on any action that sends outside your org — external email, a public post, a message to a customer — at least until you have a month of logs saying it is safe.

The market is consolidating around this problem because it is real. That is a reason to solve it, not a reason to wait for a vendor to sell it to you.

Sources: Kiteworks press release, Calcalist, Help Net Security.