Company: Kiteworks
Chairman and CEO: Jonathan Yaron
Website: https://www.kiteworks.com/
About Kiteworks
Kiteworks: Governing AI Agents and Humans at the Data Layer
People and AI agents now both touch sensitive data, and they fail in the same way. An authorised action aimed at the wrong place. A regulator will not accept “”the model was told not to.”” Over the past twelve months, Kiteworks built the answer at the one layer neither an employee nor an agent can talk their way around, the data layer.
Kiteworks provides a control plane for secure data exchange. It governs every send, share, receive, and use of sensitive data across email, file sharing, managed file transfer, forms, APIs, and AI agents, protecting over 100 million end users across thousands of global enterprises and government agencies.
Three advances define the year.
Agent and Human Error Prevention (AHEP). Traditional DLP hunts for forbidden data patterns, so it misses authorized data sent to the wrong recipient. Misdirected email was the leading data security incident reported to the UK Information Commissioner’s Office in the final quarter of 2024, at 21% of all reported incidents. Kiteworks made AHEP generally available in August 2026. AHEP evaluates recipient type, volume, identity match, attachments, and domain validity as a message is composed, and warns only when signals align. Three pre-built policies (BCC Warning, Send-to-Self Detection, and Domain Typo Detection) can start in Report Only mode, and validation runs inside the customer’s environment, so no email metadata leaves it. Every warning and every user decision is written to the audit log.
Kiteworks Compliant AI. Prompts and safety filters can be bypassed; data-layer enforcement cannot. Every agent interaction passes four checkpoints: authenticated identity linked to the human who delegated the workflow, real-time attribute-based policy enforcement, FIPS 140-3 validated encryption, and a tamper-evident audit trail streamed to the SIEM. It works with Claude, Copilot, and any MCP-compatible model, and ships three Governed Assists for folder operations, file management, and forms creation.
Kiteworks Secure MCP Server. Built on the Model Context Protocol, it evaluates every request against role-based and attribute-based access controls, so an AI client receives only what policy allows. It uses OAuth 2.1 with PKCE and token rotation, FIPS 140-3 cryptography, and hybrid post-quantum key exchange (X25519 with ML-KEM768), and it never exposes credentials or transferred payloads to the model. Release 9.5 adds administrator scope controls, off by default, and a dedicated audit category, so agent and human activity appear side by side in the same reports and CISO Dashboard.
Independent validation backs the platform. Kiteworks holds FIPS 140-3 validation (NIST CMVP certificate 4980), a BSI C5 Type 2 attestation, and NEN 7510-1:2024 certification, and has completed an IRAP assessment against the Information Security Manual’s PROTECTED-level controls, most recently reassessed in July 2026.
The industry is bolting AI controls onto the model while the exposure sits in the data. Kiteworks treats agents as governed identities alongside humans, with one control plane and one audit log across every channel. That gives a CISO prevention, and a Chief Compliance Officer evidence.
Want to find out what TechRound can do for your business?
