Hardware security tokens as mentioned can provide some security against piracy.
Not knowing what your software is, or what it does, it's hard to know what solutions could work. Are you putting the box on-site because it is more efficient? Are you putting the box on site so that the customer can administer it themselves? Is it because the customer is running it on an isolated network?
Many enterprise grade solutions use strict license agreements and cryptographicaly secure software keys with the name of the purchasing enterprise and the date of expiry clearly in them. It means that even employees who steal code only have limited use of it as the origin and time limits on its usage are clear.
But all this does little to nothing to protect against reverse-engineering.
Code obfuscators and obfuscating compilers might help you a bit. Again, it depends on your application, your application team, etc.
Physical tamper-resistance might also help, but it limits your ability to support the physical hardware. The payment card industry uses wire mesh inside some of their hardware with keys stored in volatile memory so that if the case is tampered with, important decryption keys are lost, rendering the device useless. Similar techniques are applied to HSMs (Hardware Security Modules), which are effectively tamper-resistant vaults for storing important crypto-keys.
The whole game is risk management. The expense of launching a lawsuit, the damage caused by a leak, the cost of securing the code, it all has to be weighed. Few secrets are so important that they need to be protected at all costs. The delay to market may cost you your time advantage, allowing a competitor to reach a comparable solution at a better price before you can get your locked down version out the door.