In September 2025, we launched ransomware detection and file restoration in beta to help organizations minimize the impact of malware attacks on personal computers. Today, we’re excited to share these two features are generally available with significant improvements in malware detection.Compared to when the feature was in beta, we are now able to detect even more types of ransomware encryption and are able to do it faster. Our latest AI model is detecting 14x more infections, leading to even more comprehensive protection.Thousands of users have tested file restoration, demonstrating that it’s scalable and reliable.Ransomware detection: When users have Google Drive for desktop installed on their computers, file syncing will be paused when ransomware is detected. The user will see a notification appear on their computer. Admins will see an alert in the Admin console security center; notification emails will be delivered to both users and admins.File restoration: Users are able to bulk restore their files to a previous version in Drive with ease, saving them time and money without paying a ransom. Users can select and restore multiple files prior to when ransomware infected their computer, making their files inaccessible.Getting startedAdmins:Ransomware detection will be on by default for users in your organization. You can turn it on or off at the OU level by going to Admin console > Apps > Google Workspace > Settings for Drive and Docs > Malware and Ransomware. If ransomware is detected for your users, admins will receive an email and get an alert in the Alert center.Drive file restoration will be on by default. You can turn it on or off at Admin console > Apps > Google Workspace > Settings for Drive and Docs > Drive file restoration.Install the latest version of Drive for desktop on user computers (v.114 or later) to enable the detection alerts (syncing will still be paused on older versions).Visit the Help Center to learn more about managing ransomware detection and file restoration for your organization.The Admin console setting for ransomware detectionThe Admin console setting for Drive file restoration Email to admins when potential ransomware is detectedAdmin alert in the Alert center with information on the potential ransomware detectionAlert detail on the ransomware detectionEnd users: The availability of this feature will depend on your admin’s settings. If turned on and ransomware is detected, you will see the alerts and access the interface below. Visit the Help Center to learn more about restoring files in bulk with Google DriveEnd user alert in Drive for desktop when ransomware is detectedInterface to assist with file recoveryRollout paceRapid Release and Scheduled Release domains: Available nowAvailabilityFile restorationAvailable to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts Ransomware detectionBusiness: Business Standard and PlusEnterprise: Enterprise Starter, Standard and PlusEducation: Education Standard and PlusOther Editions: Frontline Standard and PlusResourcesGoogle Workspace Admin Help: Detect ransomware and recover files in Drive for desktopGoogle Help: Restore files in bulk with Google DriveWorkspace Blog: Block ransomware proliferation and easily restore files with AI in Google DriveGoogle Workspace Updates Blog: Ransomware detection and file restoration for Google Drive available in beta