Google has officially rolled out its AI-powered ransomware detection feature for Google Drive, making it available to all eligible users and turning it on by default.
This feature was first introduced in beta in September 2025 and started reaching Google Workspace customers worldwide in early October.
With this new system in place, Google Drive can detect signs of ransomware when files are being synced from a desktop computer. If suspicious activity is found, the syncing process is immediately paused. At the same time, users receive alerts through email and within Google Drive, while IT administrators are notified through the Admin console. This quick response helps reduce the damage that ransomware can cause.
It is important to note that while this feature cannot stop ransomware from encrypting files on an infected computer, it does protect files stored in Google Drive. Stopping the sync process, it prevents encrypted versions of files from replacing the original ones in the cloud. Once the issue is resolved, users can restore their files using the Drive recovery tool.
After an attack is detected, Google also provides clear instructions to help users recover their data. The restoration tool allows users to roll back changes and recover files that may have been affected during the attack.
Google says the system has improved significantly since its beta phase. The updated AI model can now detect up to 14 times more ransomware cases and does so faster, offering stronger protection overall.
The feature is automatically enabled for organizations using Business, Enterprise, Education, and Frontline Google Workspace plans. The file restoration tool is also available to Workspace users, individual subscribers, and even personal Google account holders.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Although the feature is turned on by default, administrators still have the option to disable it through the Admin console under the Drive and Docs settings. For full alert functionality, organizations are encouraged to use version 114 or later of Google Drive for desktop, though syncing will still pause on older versions if a threat is detected.
