Kiteworks & Kasm unite to secure sensitive data flows

Kiteworks has formed a technology alliance with Kasm, linking governed data exchange with isolated, container-based workspaces for handling sensitive information across distributed organisations.

The combination is designed to tighten control over how employees and external partners access private data across multiple channels and systems. It targets regulated industries and government environments, where auditability and policy controls often need to extend beyond a single organisation.

Kiteworks provides a platform for exchanging sensitive information across email, file sharing, SFTP, managed file transfer, APIs, and data capture forms. Kasm provides browser isolation and Desktop-as-a-Service through container streaming. Together, the products let users view and work on content inside temporary, isolated sessions rather than on local devices.

David Byrnes, VP Global Channels at Kiteworks, said data is moving through more fragmented systems and partner networks, limiting oversight for security and compliance teams.

"Organisations today face an escalating challenge with sensitive data flows across dozens of channels, systems, and partners with fragmented visibility and inconsistent controls," said David Byrnes, VP Global Channels, Kiteworks. "Every file shared via email, file sharing, SFTP, managed file transfer, API, or data form represents potential exposure. Security teams struggle with disparate logging systems, compliance officers cannot prove governance end to end, and IT administrators manage a patchwork of point solutions that expand the attack surface. At the same time, adversaries are growing more sophisticated, regulatory requirements are intensifying, and the emergence of AI is creating entirely new data governance challenges that existing approaches were never designed to address."

Two-layer model

The alliance centres on a two-layer security model. Kiteworks applies governance and policy enforcement to data exchanges, while Kasm isolates the environment where users interact with that data. The aim is to keep policy decisions, monitoring, and access controls consistent even as content moves across different channels.

Kiteworks uses a single policy engine and a single audit log across its supported channels. This is intended to give security and compliance teams a consolidated record of activity for sensitive files and messages, rather than separate logs for each transfer tool.

Kasm uses container-based sessions that can be disposed of after use, reducing endpoint risk. In the model described, web content and applications are accessed in sandboxes, and user interaction stays within the isolated session.

Ryan Cason, Head of Global Partnerships & Alliances at Kasm, said the integration delivers a layered approach that neither vendor provides on its own.

"Kasm Technologies delivers zero-trust browser isolation and Desktop-as-a-Service through its container streaming platform, ensuring that all user interaction with web content and applications occurs within secure, disposable sandboxes that prevent data exfiltration and eliminate endpoint-based threats," said Ryan Cason, Head of Global Partnerships & Alliances, Kasm. "Together, Kiteworks and Kasm create a defence-in-depth approach to secure collaboration that neither technology achieves alone."

Endpoint controls

Maintaining consistent control over who can access sensitive content-and what they can do with it-is often the hardest part of collaborating with external parties. The integration is intended to address access conditions and usage controls across both the exchange layer and the consumption layer.

Kiteworks applies role-based and attribute-based access controls to exchange methods, while Kasm governs the session where a user views or edits information. In this model, private content does not need to land on the user's device. Controls can also be applied to actions such as upload, download, clipboard use, and session activity.

The combined approach targets organisations with distributed workforces and partner ecosystems, as well as environments with frequent third-party access such as supply chains, professional services networks, and regulated outsourcing arrangements.

AI governance

The companies also cite AI adoption as a driver for tighter data controls. Many organisations are testing AI tools while trying to prevent sensitive information from being copied into systems outside their governance frameworks. They also need records showing who accessed data, when, and under what authorisation.

Kiteworks extends policy controls to AI integrations through products it calls the Secure MCP Server and AI Data Gateway, including attributed logging, immutable audit trails, and automated compliance reporting.

Kasm positions its containerised workspaces as a way to keep AI-assisted workflows within controlled sessions, reducing the risk of sensitive content being extracted, cached, or exposed outside authorised activity.

The companies cited regulatory and assurance frameworks that large enterprises often manage in parallel, including HIPAA, CMMC, GDPR, FedRAMP, ITAR, the UK NIS Regulations, FCA PS21/3, and PCI DSS. They also referenced AI-related governance contexts such as the UK AI Safety Institute, SDAIA frameworks, and internal enterprise risk policies.

The alliance is available immediately and targets enterprises and government agencies worldwide.