Google is giving Drive a serious security upgrade, and it’s aimed squarely at one of the nastiest problems in modern computing: ransomware.

If you use Google Drive for desktop on Windows or macOS, Google’s new AI-powered system now keeps an eye on your files in the background, looking for classic ransomware behavior like mass encryption or sudden, unexplained file corruption. The moment it spots something suspicious, Drive automatically pauses syncing so the attack can’t happily overwrite all your clean copies in the cloud. Think of it as pulling the plug on the damage before it spreads across your entire Workspace.

This isn’t some basic rules-based filter either. Google says the latest AI model, trained on millions of real-world ransomware samples and constantly updated with threat intelligence from VirusTotal, now detects 14x more infections than the original beta version. That means it’s not just catching known strains but also adapting to new variants that try to sneak in with slightly different behavior.

The other half of the story is recovery. If an attack does slip through, Drive now lets you bulk-restore files to a safe point in time, without paying a ransom or messing with complex backup tools. You can select multiple affected files, roll them back to their healthy versions, and get back to work instead of negotiating with criminals on Telegram. For admins, there are alerts in the Admin console, email notifications, and audit logs so security teams can investigate what happened and tighten things up afterward.

By default, ransomware detection and file restoration are switched on for supported Google Workspace editions, though admins can control them at the organizational-unit level. File restoration is available even for personal Google accounts, which is a big deal for freelancers, students, and solo creators who don’t have an IT department watching their backs.

What’s interesting here is the philosophy shift: for years, ransomware has been treated as “an antivirus problem” — something you stop at the point of infection. Google’s move assumes that sometimes the bad stuff will get in anyway, so the goal is to stop it from doing damage and make recovery almost boringly easy. In a world where ransomware gangs are getting smarter, having Drive quietly acting as an AI-powered safety net might be one of the more practical upgrades you get this year.