Google’s Latest AI Ransomware Defense Only Goes So Far

Ransomware attacks have loomed for years as an urgent digital threat with no easy solution—especially as they have evolved to include data grab-and-leak attacks that may not even involve data-encrypting malware at all. Traditional ransomware that locks up files and systems is still rampant, though, and Google on Tuesday launched a new defense for its Google Drive for desktop apps that aims to quickly detect ransomware activity and halt cloud syncing before an infection can spread.

While antivirus scanners monitor for signs of malware across a system, the new ransomware protections in Drive for desktop are meant to act as an additional line of defense. The detection capability is built on an AI model that Google trained using millions of real victims' files that had been encrypted with various strains of ransomware. And the feature is designed to detect and contain suspected ransomware in desktop Drive very quickly. For enterprise Google Workspace customers, the feature is an asset, protecting files of any format that are stored in Drive for desktop and allowing users to easily restore any data that is encrypted or corrupted by malware. But like other ransomware detection and data-backup features, the tool is a treatment not a cure.

“The innovative part is doing that real-time detection and quickly stopping the sync to minimize the damage. That was what our customers were telling us they really wanted,” says Jason James, a product manager for Google Workspace. “You've got hundreds, millions, billions of users—and so to check every file quickly and accurately and wherever the user is around the world were all challenges.”