Google drive now blocks ransomware before it spreads—but only if you pay

Google Drive quietly turned its desktop app into a bouncer last night: the moment its new AI smells ransomware encrypting your files, it slams the sync gate shut and pings you and your admin. The catch? The early-warning system is gated behind Workspace Business and Enterprise plans, leaving the 1.8 billion free-tier users to find out they’ve been hit only after the damage is done.

Fourteen times more infections caught, zero seconds of pity for non-payers

Google’s post-beta numbers are brutal. The upgraded detection model now flags 14× more live ransomware strains, across polymorphic and intermittent encryption routines, in under 200 milliseconds. That latency matters: every 100 ms of delay typically lets another 3–4 % of cloud copies be overwritten. In plain English, the upgrade turns a potential company-wide outage into a five-minute coffee break for IT.

File restoration kept pace. Admins can now roll back entire folder trees to any millisecond-level snapshot taken before the attack, replacing the old one-by-one grind. The feature is live for every account, including the free tier, and Google says the median restore time for 10 000 files has dropped from 42 minutes to 73 seconds.

Free users get the mop, not the alarm

The split pricing feels almost spiteful. Ransomware does not check corporate tax IDs; it locks wedding albums, thesis drafts and sole-trader invoices with the glee it reserves for Fortune 500 data. Google’s own transparency report shows that 62 % of documented ransomware incidents on Drive last year hit personal @gmail.com addresses. Yet the new early-warning toggle is greyed out unless you cough up at least $6 per user per month.

Google argues that business customers carry higher risk and louder compliance mandates. That logic collapses when you realise the same neural network runs on the same GPUs for every byte that crosses its data centres. The marginal cost of flicking the detection switch for free users is, in cloud terms, a rounding error.

The move mirrors the industry’s habit of dressing consumer security as a luxury upsell. Apple waited three years to ship Advanced Data Protection to non-payers. Microsoft still reserves the best phishing filters for E5 licences. Google just made the tiering explicit: pay or pray.

What you can still do tonight

If you refuse to upgrade, at least weaponise what remains free. Turn on Google’s two-week version history for Docs, Sheets and Slides— ransomware can’t overwrite what is permanently branching. Export a weekly Takeout archive to cold storage; 50 GB on a USB-C stick costs less than a latte. And segment your life: keep the folder that holds your tax returns offline and air-gapped, because Google’s goodwill clearly ends where the invoice begins.

Google’s engineers deserve credit for building a model that can outrun crypto-malware in real time. Their finance department deserves the side-eye for turning that breakthrough into a subscription tease. Until the paywall falls, the safest cloud is still the one you refuse to trust blindly.