UPDATE: After testing Drive’s AI-powered ransomware detection with a limited group of users last year, Google is rolling it out to all Workspace users this week.
The feature is enabled by default and pauses file syncing when the system detects potential ransomware activity. It also provides users with the option to restore unaffected file versions by going to Settings > Restore file versions. Users and admins get notified of potential infections.
Since its debut last year, the feature has improved to detect 14x more infections, Google says. While Drive’s ransomware detection could prove useful, it comes with one major caveat: it only works with the desktop app on Windows and macOS.
Another limitation is that only admins can control the feature. To disable it, admins must go to Admin console > Apps > Google Workspace > Settings for Drive and Docs > Malware and Ransomware. The option to enable or disable Drive file restoration is also on the same page.
Original Story 9/30/25:
Google is adding new AI-powered ransomware detection for Google Drive on desktop.
The new protection is trained on millions of real-world ransomware samples and is capable of identifying maliciously modified files in Drive. Once the app detects “unusual activity that suggests a ransomware attack, it automatically pauses syncing of affected files, helping to prevent widespread data corruption across an organization’s Drive,” Google says in a blog post.
Additionally, users will receive alerts for malware detection and instructions to recover healthier versions of their files via app notifications and email. “This rapid recovery capability helps to minimize user interruption and data loss, even when using traditional software such as Microsoft Windows and Office,” Google says.
To keep up with the growing threat, Drive’s “detection engine adapts to novel ransomware by continuously analyzing file changes and incorporating new threat intelligence from VirusTotal,” Google adds in its blog post.
The feature is enabled by default on Drive for Windows and macOS, but admins can disable it and initiate file restoration. They also receive alerts on their console and can review the audit log from the security center.
Google Drive’s AI-powered ransomware detection begins rolling out today in open beta for “most Workspace commercial plans at no additional cost.”
About Our Expert
Jibin is a tech news writer based out of Ahmedabad, India. Previously, he served as the editor of iGeeksBlog and is a self-proclaimed tech enthusiast who loves breaking down complex information for a broader audience.
-
Samsung Brings Blood Pressure Monitoring to Galaxy Watches
-
Returning Your New Phone to T-Mobile Just Got More Expensive
-
Range Anxiety? Google Maps Now Plans EV Charging Stops on Android Auto
-
Sora Video Generator Reportedly Costs OpenAI $1 Million a Day
-
Bluesky’s Attie AI Will Let You Request Custom Feeds
-
More from Jibin Joseph
