Google Drive Expands AI Ransomware Detection, File Recovery to More Users

Google has officially launched its AI-powered ransomware detection and built-in file recovery features for Google Drive, moving them from beta to general availability. The core upgrade is a new AI model that Google claims identifies 14 times more ransomware threats than previous methods. When Drive for desktop detects suspicious encryption activity, it immediately pauses file syncing to prevent infected files from propagating to the cloud. The system then triggers a coordinated alert flow, notifying the affected user on their computer and sending an email and console alert to IT administrators, enabling a rapid response.

Once a threat is contained, users are guided to a dedicated restoration interface. This tool allows for the bulk selection and recovery of earlier, uninfected versions of files, which Google positions as a simpler alternative to traditional device re-imaging or third-party recovery tools, especially for common Windows and Office environments. File restoration is available to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts, giving it wide reach. However, the proactive ransomware detection feature is limited to specific paid tiers including Business Standard/Plus, Enterprise Starter/Standard/Plus, and Education/Frontline plans. For eligible organizations, both features are enabled by default but can be managed separately in the Admin console.