Overview

• Available on Windows and macOS, the Drive for desktop feature uses an AI model trained on millions of VirusTotal samples to spot bulk file encryption or corruption.
• When suspicious activity is detected, Drive pauses syncing to protect clean versions in the cloud and notifies both the user and IT administrators.
• A built-in recovery flow lets users restore multiple files to a previous healthy state with a few clicks, guided by desktop and email prompts.
• The capability is enabled by default for most Google Workspace commercial plans, with admin audit logs and console controls to review incidents or disable the feature.
• Google says the tool complements antivirus rather than replacing it, and consumers also receive the file restoration functionality at no additional cost.