Google drive now blocks ransomware 14× faster—unless you use the free tier

Google Drive just turned into a bouncer that can spot ransomware, slam the door, and hand you back your untouched files. The catch? The bouncer only works if you pay for a seat at the VIP table.

Google confirmed late yesterday that its AI-powered ransomware shield has left beta and is live for every Workspace Business and Enterprise desktop client. The moment the model sniffs out encryption behavior, Drive halts sync, freezes the corrupted payload on the device, and pings both user and admin. The company claims the upgraded neural net now catches 14 times more infections, across a broader family of encryption schemes, than the early preview could manage.

Rollback button ends the one-file-at-a-time nightmare

Alongside the early-warning system, Google bulked up its restoration engine. Victims can now select every scrambled file in one sweep and rewind the entire set to the timestamp just before the attack. The tool is already available to free-account holders—an olive branch that softens, but doesn’t hide, the paywall in front of the part that actually prevents the damage.

Consumer accounts get the mop, not the smoke detector. Without detection, by the time you notice ransom notes, your local Drive folder has already uploaded a poisoned copy, triggering a frantic race against sync. Google’s own stats show consumer Drive users suffer ransomware hits at roughly one fifth the frequency of small-business tenants, but the absolute numbers remain in the hundreds of thousands globally each quarter.

The pricing friction lands amid Google’s loudest security drumbeat in years—quantum-resistant tunnels for Android, real-time code scanning in the Play Store, and now this. Leaving everyday users with yesterday’s malware radar feels like handing out airbags only on luxury trims.

Google argues that enterprise tenants foot the bill for the cloud GPUs that chew through behavioral signals every time a file changes. Yet the marginal cost of pinging a free user—“suspicious activity detected, sync paused”—is measured in fractions of a cent. The subtext: security sells seats, and seats sell subscriptions.

Bottom line: if your Drive is on the free plan, keep offline backups and pray the crooks stay dumb. Google already proved it can stop the heist before the safe snaps shut. It just chose not to do it for you.