Google is taking cloud security to the next level , announcing that ransomware detection in Google Drive is now generally available and enabled by default for all paid users . The development marks a more aggressive strategy against one of the most dangerous forms of cyberattacks in recent years .
The feature was first introduced in beta in September 2025 and began rolling out to users Google Workspace shortly thereafter. Now, Google is fully integrating it into its ecosystem, making it a core data protection feature.
How ransomware detection works in practice
The new feature leverages artificial intelligence to detect suspicious activity when syncing files from computers to the cloud. If signs of ransomware-related encryption are detected, the system immediately freezes the sync, preventing the attack from spreading to stored files.
See also: Bearlyfy targets Russian companies with GenieLocker ransomware
At the same time, notifications are sent to both the user and IT administrators, and a corresponding alert is created in the management console. This way, organizations can react quickly before the damage spreads.
Protection in the cloud, even if the system is infected
One of the most important advantages of the feature is that, even if a computer has already been compromised, files located in the cloud remain protected. Ransomware can encrypt local data, but it doesn't have time to sync changes to Drive.
This allows users to quickly restore their data using the platform's recovery tools . Google also provides step-by-step instructions for the recovery process, making it easy for even non-technical users.
AI that evolves and improves
Compared to the beta version, the new implementation appears significantly enhanced. According to Google, the artificial intelligence models used can detect up to 14 times more ransomware infections, while operating faster and with greater accuracy.
This development reflects the general trend of utilizing AI in cybersecurity, where systems no longer rely solely on known malware signatures, but on behavioral analysis and activity patterns.
Availability and control by administrators
The feature is enabled by default for organizations using enterprise, business, education, and frontline editions of Google Workspace. Meanwhile, file recovery tools are available to both business and personal users.
See also: The Port of Vigo was “hit” by a ransomware attack
However, administrators retain the ability to disable the feature via the admin console, offering flexibility for environments with special requirements. To fully utilize notifications, the latest version of Google Drive for desktop is required, although basic protection also works in older versions.
Competition in cloud security intensifies
Google isn't the only one investing in such capabilities. Microsoft offers similar ransomware detection and recovery features through OneDrive, while Dropbox has integrated similar tools into more advanced subscription plans.
This convergence shows that security is now a key competitive advantage in cloud services and not just an additional feature.
Ransomware as a constant threat
The growing adoption of such technologies is no coincidence. Ransomware attacks continue to evolve, targeting not only large enterprises but also smaller organizations and individual users.
The move to cloud environments creates new challenges, as mass data storage on centralized platforms makes it an attractive target for attackers. However, it also allows for more centralized and effective defense.
See also: Russian hacker jailed for involvement in ransomware attacks
The future of cloud security
Google's move underscores a significant shift in philosophy: security is no longer the sole responsibility of the user, but is actively built into the services themselves. With artificial intelligence taking on the role of "guardian" of data, the cloud becomes not only more functional but also more resilient to modern threats.
As attacks become more sophisticated, such solutions are expected to become the rule rather than the exception, shaping a new standard for protecting digital information.
Source: www.bleepingcomputer.com
