Google Launches Drive Ransomware Detection Beta

Google has launched an AI-driven ransomware detection feature for Drive for desktop (Windows and macOS) that monitors file activity and automatically pauses syncing when it detects suspicious mass encryption or corruption to limit spread to the cloud. The model, trained on millions of real-world ransomware samples, combines AI signals with VirusTotal threat intelligence to spot abnormal file changes across many file types. When detection occurs Drive locks affected files, sends desktop and email alerts, and provides a dashboard for users to restore older versions (Drive retains prior versions for up to 25 days); administrators can receive alerts or disable the capability. The feature entered open beta on Sept. 30, is enabled by default, and Google says it will be included at no extra cost for most Workspace commercial plans and consumer users, with a goal of general availability by year-end. Google and security experts emphasize this is an additional defensive layer, not a replacement for endpoint protection or backups amid rising ransomware activity.