Connecting the dots: Ransomware has become one of the most devastating threats in the digital era, locking away critical files and demanding costly payouts. When combined with AI and cloud computing, the risks and stakes raise even higher. However, Google is betting that AI models can play a crucial role in protecting users' data, even during an active ransomware attack.
Google believes that the constantly evolving ransomware threat requires a novel approach to prevention and detection. To that end, the company has announced a new AI-powered anti-ransomware feature for its Drive desktop utility, designed to stop file-encrypting malware even after it has breached a system.
Ransomware remains one of the most dangerous threats facing organizations and individual users. These attacks can cause significant financial losses, disrupt business operations, and compromise sensitive data. Industries ranging from healthcare, retail, and education to manufacturing and government have all been affected.
To address this, Google is enhancing Drive with an AI-based detection system that can automatically pause file synchronization if a ransomware infection is detected. According to the company, native Workspace documents and ChromeOS are largely safe from such attacks, but major desktop platforms like Windows and macOS may benefit from this additional layer of protection.
Google describes this as an "entirely new" layer of anti-ransomware defense, designed to work alongside traditional anti-malware protections. The company trained its AI model on millions of real-world ransomware samples, making it capable of detecting the strongest indicators of new ransomware infections.
Furthermore, the model is being continuously improved by analyzing new samples going through the VirusTotal platform. Google said that the new protection is based on a "detection engine" that can incorporate new VT threat intelligence, which sounds more like a traditional anti-malware product than a hallucination-prone AI model.
Importantly, Google emphasizes that the new AI model is not trained on customer data. Users' files are not used to train or fine-tune the system unless explicit permission has been granted.
According to Bob O'Donnell, chief analyst at Technalysis Research, the feature "is great not only for Google Workspace users but individuals and companies who may use other office productivity suites as well."
Currently available in open beta, the AI-powered ransomware protection can also restore unencrypted files from the cloud during an active infection. Administrators will have access to added controls, with Workspace's Admin Console delivering alerts when ransomware activity is detected across their networks.
Google launches AI ransomware detection in Drive desktop, trained on millions of attack samples
