AI vs Ransom: Ransomware threats and cloud storage can quickly become a dangerous combination. When malware encrypts files stored on internet servers, users and organizations are often left without an easy way to recover their data. Google has been working on a potential solution for months and is now ready to introduce it to its paying cloud customers.
Google officially announced its new anti-ransomware protections in September 2025, and the company is now making these tools available to Workspace customers using Google Drive for Desktop. The security features leverage a specially trained AI model, which has been further developed and refined over the past few months.
The latest model can detect 14 times more ransomware-related infections than previous versions. The new AI works faster and provides significantly stronger protection compared to when the feature was still in beta. Thousands of users have reportedly tested the tool, demonstrating its ability to scale and reliably achieve its intended purpose.
Google's new anti-ransomware shield includes both ransomware detection and file restoration. The detection system uses the specialized AI model to monitor suspicious behavior when Google Drive for Desktop is running on a PC. If ransomware-like activity is detected, the feature halts any file syncing and alerts the user via a desktop notification. Administrators also receive alerts through the console's security center and via email.
After a ransomware threat is detected, customers can replace the local encrypted files with clean copies stored in Google Drive. File restoration can save time and money by eliminating the need to pay a ransom, and it can be applied to multiple files at once, Google said.
Ransomware detection and file restoration are already available to both end users and IT admins in enterprise organizations. Both features are activated by default, though administrators can disable them for the entire company if they choose. Detection alerts for ransomware-like activity require the latest version of the Drive for Desktop client (v114 or later).
Google said the new security features are designed to minimize the impact of malware attacks on PCs within a Workspace-based organization. Despite growing threats from large language models, agentic browsers, and AI services, ransomware infections remain one of the most severe risks to user and business data.