Solving social issues without jeopardizing information
With a mission to “dream up the future,” Nomura Research Institute (NRI) aims to help solve social issues and build a sustainable society. Advancing that mission requires the ability to apply AI to workflows while ensuring confidential information management.
One of Japan’s leading think tanks and IT services companies, NRI provides a wide range of services, from management strategy consulting to system development and operations. NRI adopted Box for content management in 2017 and has since added Box Shield for stronger security measures.
In the age of AI, NRI upgraded to Box Shield Pro to implement classification labeling for internal documents. This task had always been manual, but now, NRI combines AI-based automatic classification with final human review — improving classification accuracy while also promoting the adoption of a document classification culture.
The road to zero-trust content management architecture
NRI first adopted Box to eliminate the security risks of dispersed, per-department file servers and build a company-wide information-sharing platform. Today, the company is building on that foundation to transform its business and operational processes with AI.
A critical consideration: security and compliance. NRI frequently handles customers’ confidential information and management-related data. As a result, the company is constantly required to maintain a level of security higher than that of ordinary companies. Tatsutoshi Murata, General Manager, IT Strategy Department at NRI, notes that security incidents at other companies have occurred one after another in recent years, and as a result, customers ask NRI about security measures much more often.
In addition, Murata says, “Preparing for information leakage risks has become more important than ever, including within our company, group companies, and partners. For that reason, we are strengthening our information security measures from the perspectives of business continuity and customer trust.”
We’ve found it extremely reassuring that Box offers multi-vendor support, allowing us to flexibly switch between AI models, while providing security management capabilities that span prevention, detection, and response.
Zero trust is the goal NRI has been working toward for the past several years, and that — along with the need for data centrally managed in the cloud, ID authentication, device management, and network controls — led straight to Box.
Murata confirms, “As we rapidly advance our utilization of AI agents, we expect Box, which has consistently led the development of security management capabilities for secure collaboration, to provide the administrative features needed to safely leverage this new era of AI.”
He adds, “We’ve found it extremely reassuring that Box offers multi-vendor support, allowing us to flexibly switch between AI models, while providing security management capabilities that span prevention, detection, and response. With a protective layer that appropriately manages AI agent access to content, we’re confident our critical content will remain protected as we expand our use of AI.”
Enhancing information leakage countermeasures with Box Shield
NRI relies on Box Shield for advanced security capabilities. Using threat detection, Box Shield detects access from suspicious locations or devices and large-volume downloads, while smart access functionality applies access controls according to classification labels.
These capabilities have strengthened countermeasures against both careless behavior and malicious behavior — major causes of information leakage.
With Box Shield, for instance, NRI was able to systematize how they watch for employees who download content around the time of their resignation. In the past, administrators had to confirm such incidents manually, but now, they can institute rule-based checks through the detection of large-volume downloads and other anomalous activity.
“In addition,” says Yui Oto, Associate, Digital Workplace Business Department III at NRI, “smart access functionality has reduced the risk of information leakage due to operational mistakes, creating a state in which guardrails function without administrators having to respond each time.”
Alerts detected by Box Shield are linked to the log analysis platform Splunk, visualized on dashboards, and shared with department heads. This has created a framework in which, when an employee resigns or suspicious behavior is observed, department heads themselves can review the user’s activity and connect those insights to early detection of abnormalities and rapid response.
But the framework does not depend upon busy department heads proactively checking dashboards.
“When a large-volume download occurs, email notifications are sent to the user and the department head,” explains Shuhei Harada, Expert, Digital Workplace Business Department III. “As a result, employees naturally become aware that their actions are visible, reinforcing that misconduct is difficult to conceal in this environment. By combining detection through logs, confirmation by supervisors, and user awareness, we are applying deterrence from three directions.”
Automating labeling with Box Shield Pro’s AI classification
Box Shield Pro was the natural next step to securing NRI’s content.
Classification label assignment depended on manual work, and even with classification rules to follow, people often assigned labels to files inconsistently, and classification omissions were common.
NRI also needed a way to prove its track record of confidential classification operations in the event of court proceedings. In Japan, if an employee downloads information, certain conditions must be met for that information to be recognized as a “trade secret.” For instance, the company must have a system of “secrecy management,” which means the ability to organize and clarify confidential classification rules, communicate them to employees, and thoroughly enforce the assignment of classification labels to files. Without these steps, no content can be considered “confidential.”
Box Shield Pro’s AI Classification Agent capability uses AI to analyze content and context and automatically assign classification labels based on standards defined by the organization. Now, NRI can automate classification on the same platform where it stores content.
Yuko Aoki, Expert, IT Strategy Department at NRI, notes that other solutions require building workflows to link data to separate classification or security platforms, but “with Box, there is no need to create such additional mechanisms, and because a large amount of internal data is already consolidated in Box, it is attractive that everything from labeling to access control can be carried out seamlessly.”
Granular classification of company content
Box Shield Pro allows NRI to get super granular with its data classification, enabling four labels:
- Top Secret
- Confidential
- Internal Use Only
- Public
Administrators define the content and decision criteria corresponding to each category, and then the process works as follows:
- When a file is saved to Box, AI analyzes the content and automatically determines and assigns a classification label
- The determination result is presented to the employee in a pop-up to approve the classification label
- Box Shield smart access functionality automatically applies access controls such as external sharing and downloading
This system, being implemented now, will make it possible to automatically assign appropriate classification labels to all files without omission, addressing issues like dependence on manual labeling and ensuring secrecy management. Box Shield Pro can define which combinations of information should be treated as Top Secret based on the content and context of the text, enabling flexible classification that reflects actual conditions.
The company also plans to take advantage of workflow automation from Box Automate to establish an operation in which manager approval is mandatory for Top Secret and Confidential labels. “In terms of design philosophy,” says Harada, “we place importance on a fail-safe approach in which anything suspected of being confidential is treated conservatively and given a temporary label.”
Human-led agentic design
NRI values human decision-making — not leaving everything to AI, but ensuring that decisions require human review. Harada emphasizes the importance of human-in-the-loop design: “We encourage employees to confirm, through pop-ups and similar mechanisms, the final decisions.”
Oto adds, “Our goal is not to impose strong restrictions on employees, but to create a state in which they can naturally stay aware of security in their daily work. We want to increase everyday moments of awareness in a way that does not hinder operations.”
This emphasis on human review helps prevent AI mistakes and ensures that files are indeed accurately classified, but almost more importantly, helps establish a culture in which people are highly aware of classification and document security.
“In the AI era,” adds Murata, “ideal security is a state in which comprehensive protection by systems and improved awareness among each employee coexist. If left to individuals alone, the quality of response varies, so it is meaningful for AI to help raise that baseline. Security is not a constraint on operations, but a foundation for using data safely.”
Coming soon, ransomware detection
Going forward, NRI also plans to use Box Shield Pro’s Ransomware Activity Detection and AI Threat Detection Agent.
Previously, ransomware measures with Box Shield were centered mainly on post-incident response, but ransomware-driven file encryption is characterized by repeated file updates at a speed unimaginable for humans. For that reason, the company expects that AI-powered real-time detection will enable it to identify abnormalities early and respond quickly through session termination and recovery.
NRI is building a new information management platform that balances security and convenience by appropriately combining the roles of AI and people. With the capabilities of Box, NRI is implementing a stronger level of security across the company without placing excessive burden on employees.
