From Research to Reality—Scale Academy: NTT Research’s New Business Incubator Launched in NTT Research 2.0, and Its First Project SaltGrain

3.1 Mission and organization

The mission of Scale Academy is “to identify technologies with strong business potential and guide them through the early phases of business success.” It is positioned as a specialized business incubator dedicated to commercializing and scaling scientific discoveries and unique concepts originating within the NTT Group.

The initiative begins with the technology assets held by NTT Research, with plans to expand collaboration to NTT research and development (R&D) laboratories and the laboratories of NTT Group companies. Led by Bennett Indart (senior vice president of Business Incubation at NTT Research), Scale Academy operates with a dedicated team covering business development, application development, investment, and other commercialization functions.

3.2 The process of transforming technology into market value

Scale Academy guides technologies to market through a phased process: Discover, Incubate, Commercialize, and Scale. Each phase incorporates milestones and funding gates to ensure disciplined decision-making throughout.

A key feature of this process is that it is grounded in a fundamental truth about technology-driven commercialization: superior technology alone does not create a market. While the combination of component technologies can expand the range of applicable use cases, an overly broad set of possibilities can make it difficult to identify where to focus. It is therefore essential to translate component technologies into concrete functions and rigorously explore and validate use cases that deliver genuine value. Scale Academy is building organizational knowledge to increase the likelihood that inventions successfully become innovations that have commercial value.

3.3 An open approach to business development, starting from Silicon Valley

Scale Academy makes full use of the strategic advantage of NTT Research’s location in Silicon Valley. Early engagement with venture capitalists (VCs) as part of the capital structure, immediate access to global market ecosystems, and a flexible exit strategy that includes the possibility of future spinouts are approaches that can be actualized naturally within the Silicon Valley ecosystem.

By actively embracing external capital and collaboration with outside partners for promising technologies, Scale Academy aims to bring NTT Group’s research assets to society on a broader scale. This open-minded approach embodies the new role that Scale Academy envisions for a research institution.

4.1 The origins and evolution of ABE: The trajectory of an invention born from basic research

The core technology behind SaltGrain is attribute-based encryption (ABE). ABE was co-invented in 2004 by Dr. Amit Sahai of UCLA and Dr. Brent Waters, who serves as director of the Cryptography & Information Security Laboratories at NTT Research. In 2020, Dr. Sahai and Dr. Waters received the Test of Time Award from the International Association for Cryptologic Research (IACR) for their foundation research paper on ABE [1].

At the time of its publication, ABE was merely one cryptographic theory among many. However, over the course of two decades of research, it has intersected with significant changes in the technological landscape—the rapid growth of digital data, transition to cloud computing, and emergence of AI—and is now poised to attain its full potential. This serves as a symbolic example of how fundamental research can anticipate and shape future trends. ABE integrates access control functions into encryption. For instance, with the appropriate policy encrypting data with ABE, successful decryption can only occur when a user’s attributes (such as job title, department, or authorization level) match the policy conditions. With conventional public-key cryptography, however, a one-to-one encryption key and decryption key model is assumed. ABE, however, achieves flexible, one-to-many, condition-based access control at the cryptographic level—a fundamental distinction. Over the years, researchers at NTT have enhanced ABE’s performance and feature richness, including post-quantum security. The technology’s maturity has steadily advanced, leading to its selection as the inaugural project under Scale Academy.

4.2 Protecting “the data itself”: The technical features of SaltGrain

Traditional security implementations in the marketplace have been built on the principle of perimeter defense. However, this approach carries a fundamental vulnerability: once data leaves the security boundary, its protection is no longer guaranteed. In today’s environment where cloud and multi-vendor deployments are the norm and AI-driven workflows are widespread, this limitation has become increasingly serious.

SaltGrain embeds access policies directly into encrypted data, ensuring that protection and access control travel with the data wherever it moves. Even if a malicious actor successfully breaches a system and exfiltrates data, that data remains nothing more than worthless ciphertext. The concept of “protecting the data itself” addresses the fundamental limitations of perimeter-based security.

SaltGrain enables fine-grained access control at the data layer—something the current data protection tools in the marketplace have not been able to achieve. It supports selective protection of specific content within files, regardless of format: text, images, video, and more. SaltGrain is also equipped with post-quantum cryptography compatibility, ensuring long-term cryptographic security in anticipation of the era of practical quantum computing. The product name “SaltGrain” combines “Salt,” a cryptographic term referring to the strengthening of hash-based security, and “Grain,” representing the granular access control made possible with ABE. The SaltGrain architecture is built around several core components, e.g., an ABE cryptographic engine, policy management platform, and key management system. SaltGrain also provides the flexibility to integrate with client’s existing systems, e.g., IdP (identity provider) via API (application programming interface), thus lowering the barrier to deployment within existing infrastructures. SaltGrain also supports the requirements of supply chains, financial institutions, and healthcare with multi-authority capabilities, allowing different organizations to work seamlessly together with different trust models.

4.3 A data protection foundation for the age of AI agents

The rapid proliferation of generative AI and AI agents brings tremendous benefits to enterprise data utilization while simultaneously introducing new challenges from a data security perspective. With traditional security designs, it was assumed that humans would be the primary actors accessing data. However, in environments where AI agents autonomously reference and process large volumes of data, the diversification of access entities and the dramatic increase in processing speed have qualitatively transformed the risks of unintended data leakage and misuse. This is precisely why new data protection mechanisms are needed—ones that go beyond perimeter defense, manual oversight, and binary authentication for AI agents.

By leveraging the ABE mechanism, SaltGrain enables precise control over the range of information accessible by AI agents at the attribute and policy level. This enables sensitive and regulated information contained within the large document sets referenced by AI in RAG (retrieval-augmented generation) pipelines and analytics workflows to be selectively protected and decrypted based on user attributes (Fig. 3). The decryption log mechanism built into SaltGrain enables the recording of “when, which AI agent, which data, and under what authorization access occurred.” This approach, which places AI agent behavior in a visible and auditable state, carries important significance from an AI governance perspective. By covering both input and output data across AI workflows by enforcing proper access policy with ABE, SaltGrain functions as a foundation for safe and responsible AI utilization.

Fig. 3. ABE utilization in a RAG environment.

SaltGrain’s value proposition—eliminating the trade-off between data utilization and security—is generating strong resonance in conversations with prospective customers. Organizations seeking to accelerate AI and digital transformation while grappling with the challenge of balancing secure data handling with active data use have expressed significant interest. Demand is growing across all industries, including finance, healthcare, government, and manufacturing, where large volumes of personal information and confidential data are handled.