Bonfy unveils ACS 2.0 to secure data for AI agents

Bonfy has launched Adaptive Content Security 2.0 (ACS 2.0), a data security platform focused on how enterprise data is accessed and moved by AI agents, copilots and generative AI workflows.

The release comes as security teams face widening visibility gaps as autonomous or semi-autonomous systems read, write and share sensitive information across applications. Many existing data loss prevention and data security posture management tools focus on users and static repositories. AI agents change that model by operating across multiple systems and generating new outputs.

Bonfy positions ACS 2.0 as a policy layer across email, software-as-a-service applications, collaboration tools, browsers, cloud storage and on-premises file stores. It also targets AI systems and agent frameworks, where prompts, intermediate steps and generated content can move outside standard control points.

Bonfy plans to preview the platform at RSAC, focusing on AI agents and what it calls shadow AI workflows.

Agent-focused controls

ACS 2.0 treats AI agents as distinct entities rather than extensions of a human user account. The goal is to help security teams track which agent accessed data, how it processed that data and where outputs were sent.

"AI agents are about to become the biggest catalyst in our market, and the biggest new attack surface enterprises have seen in a decade," said Gidi Cohen, co-founder and CEO of Bonfy. "They read, write, click, send, and connect to everything. Our mission with Bonfy 2.0 is simple: protect the data across that entire lifecycle, no matter which agent, platform, or workflow is in play."

The product includes an AI Agent Data Guardrails feature that supports the model context protocol and other agent framework connections. Bonfy said this allows inspection of content agents read, share and generate during operation, not just the final output.

ACS 2.0 also adds a browser extension to monitor web traffic tied to unsanctioned AI tools and browser-based assistants. This targets shadow AI use, such as employees pasting sensitive content into public tools or using assistants that are not approved under corporate policy.

Coverage and integration

Bonfy has expanded integrations for major productivity suites and common business applications. ACS 2.0 includes native coverage for Microsoft 365 services, including Exchange Online, SharePoint, Entra, Copilot and Purview. It also supports Google Workspace services, including Gmail, Google Drive and Google Directory. The platform connects with applications such as Salesforce, HubSpot and Slack, as well as AWS S3 and on-premises file stores.

Bonfy said the Google Workspace additions bring parity with its Microsoft integrations, which matters for organisations running mixed environments that want consistent handling of unstructured data across email, file sharing and collaboration tools.

ACS 2.0 integrates with identity directories such as Microsoft Entra and Google Directory, Bonfy said. It also connects with security operations tools including Splunk, Microsoft Sentinel and Rapid7 for event and workflow handling. Bonfy also offers an MCP server interface and APIs for connections to AI platforms including Microsoft Copilot Studio, OpenAI, Anthropic Claude and Google Gemini, as well as other enterprise agent frameworks.

Visibility of data

Bonfy added a data surface visibility view that maps where sensitive content resides across repositories such as SharePoint, Google Drive, AWS S3 and on-premises file stores. The view also shows how employees and AI agents interact with that content, the company said.

Bonfy said the platform covers unstructured data at rest, in motion and in use. The scope reflects a broader security trend: connecting controls across storage, messaging and browser activity as data moves between systems and into AI workflows.

Organisations are facing a growing variety of agent frameworks from major vendors, said Tal Hornstein, CISO of Cast & Crew. "The AI agent factory is already here," Hornstein said. "Microsoft, Google, Salesforce, ServiceNow, and the hyperscalers are all shipping frameworks for building agents. Bonfy gives enterprises a way to say: Yes, we want the productivity, but we're not willing to lose control of our data to get it."

Security controls

ACS 2.0 includes data minimisation measures, encryption updates and configurable retention settings, Bonfy said. The company also said it completed SOC 2 Type 2 certification as part of the release.

Agent deployment models can reduce the effectiveness of endpoint-focused controls, said Vishnu Varma, head of product at Bonfy. "System-level agents won't run on endpoints you control. They'll run in compute infrastructure provided by Microsoft, Google, OpenAI, Anthropic, Salesforce, and everywhere else your data already lives, thereby making it extremely simple and straightforward for these agents to access that data (and more) through available tools to enhance their learning with enterprise-specific data," Varma said. "Endpoint-, browser-only DLP can't see that world. Bonfy was built as a multi-channel platform precisely so we can protect content wherever those agents operate."

Bonfy said ACS 2.0 is available immediately, with product demonstrations planned around its RSAC presence.