Recording and Highlights - Introducing Box Shield Pro

Thanks to ​@Ben Weiner from Box ​@drew-v and ​@Aikokrishna Box for yesterday’s great overview and demo. You can find the recording and highlights here and below.

Section 1 - Box Shield Pro Introduction

Recording clip here

​@Ben Weiner from Box shared how Box Shield Pro builds upon the capabilities of Box Shield, integrating AI and scaling it’s its effectiveness. ​@Ben Weiner from Box noted: "Shield Pro really just builds on and expands these capabilities, enabling them to get ahead of scale and speed and some of the new threats we're facing."

Key Components of Box Shield Pro:

1. AI Classification Agent: Supports automatic content classification based on organizational policies.

2. Context-Driven Classification: Improves precision by leveraging file activity and contextual data.

3. Ransomware Activity Detection: Tracks file modification behavior indicative of ransomware attacks from endpoints or external collaborators.

4. AI Threat Analysis Agent: Provides concise summaries of alerts for faster decision-making (launching January).

​@Aikokrishna Box showcased how AI-powered classification policies align with existing organizational workflows. She shared use cases for applying labels such as "public," "restricted," and "internal" data, along with the flexibility of defining criteria using natural language processing (NLP). "We do have AI also provide the reasoning for why they classified it with that label... This transparency helps customers understand why something’s getting classified."

​@Aikokrishna Box explained the workflow: "It is scanning the document upon any file activity... upload, preview, download, share, move, adding a collaborator to the file."

Section 2 - Advanced Threat Protection: Ransomware Detection

Recording clip here

A feature of Box Shield Pro is its ability to detect and respond to ransomware threats. ​@drew-v emphasized its importance in combating the growing ransomware threat: "Ransomware is continuing to climb. It's up 37% year over year... Any kind of cloud content management solutions, it's going to be a constant threat."

How Shield Pro’s Ransomware Detection Works:

1. Monitoring for Mass Encryption Activity: Identifies suspicious file modifications that might indicate ransomware activity on endpoints.

2. Session Termination: Allows admins to terminate affected user sessions, cutting off ransomware’s access to Box content.

3. Content Recovery Integration: Enables fast restoration of large volumes of affected files. A recent demo showcased recovery of files in a short space of time. 

​@drew-v shared a technical scenario: "If their endpoint gets compromised with ransomware, that ransomware process would have access to their Box content... And as that process is happening locally and encrypting content, those changes are getting synced to the cloud."

Shield Pro also detects suspicious actions from external collaborators. For example, alerts are generated if external users rename or modify large numbers of files that appear suspicious.

Section 3 - Bringing AI Into Threat Analysis

Recording clip here

Box will soon introduce AI Threat Analysis, an intelligent feature designed to summarize dense alert data into actionable insights. ​@drew-v  explained:

"One of the feedback items we've gotten from customers regarding our Shield alerts is that they have a lot of dense information... AI Threat Analysis takes our detection rules and uses Box AI to generate a very clear and concise summary."

The feature’s goal is to streamline threat response workflows, giving administrators better clarity on whether an alert’s severity demands immediate action.