Google Drive now auto-detects ransomware and pauses sync - 14x better detection than beta

Google moved its AI-powered ransomware detection for Google Drive from beta to general availability, enabled by default for all paid Workspace users. When ransomware encrypts files on a synced desktop, Drive immediately pauses syncing to protect cloud copies, alerts both the user and IT admins, and offers bulk file restoration to roll back to pre-infection versions. Google says the GA model catches 14 times more infections than the beta, covering a wider range of encryption patterns at faster detection speeds.

Check

Verify your Google Workspace deployment is running Google Drive for desktop v114 or later to get full detection alerts.

Affected

Google Workspace organizations on business, enterprise, education, or frontline licenses. Personal Google accounts get file restoration but not ransomware detection.

Fix

Ensure Drive for desktop v114+ is deployed across endpoints. Confirm ransomware detection is enabled in Admin console (Apps > Google Workspace > Settings for Drive and Docs > Malware and Ransomware). Test the file restoration workflow with your incident response team before you need it.