A system comprising: one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device; determining that one or more compromised server-stored files from the plurality of server-stored files are affected by a malware activity; identifying an infection time at which the one or more compromised server-stored files became affected by the malware activity; computing a buffer time based on previously selected cloud storage server restore times relative to corresponding previously suggested restore points, wherein the buffer time is added or reduced to the restore time of the detected malware activity to ensure a safe restore time; determining a plurality of recovery options based on an identification of the one or more compromised server-stored files and the infection time at which the one or more compromised server-stored files became affected by the malware activity, the plurality of recovery options comprising a suggested restore point identifying, based on the infection time and the buffer time, a restore time to which changes to the one or more compromised server-stored files are reverted; transmitting a recovery notification to the client device, the recovery notification indicating the plurality of recovery options; and receiving a user-selected restore point from a client storage application of the client device; providing said user-selected restore point to a server storage application within the cloud storage server which restores the cloud storage account at the user-selected restore point. one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device; determining that one or more compromised server-stored files from the plurality of server-stored files are affected by a malware activity; identifying an infection time at which the one or more compromised server-stored files became affected by the malware activity; computing a buffer time based on previously selected cloud storage server restore times relative to corresponding previously suggested restore points, wherein the buffer time is added or reduced to the restore time of the detected malware activity to ensure a safe restore time; determining a plurality of recovery options based on an identification of the one or more compromised server-stored files and the infection time at which the one or more compromised server-stored files became affected by the malware activity, the plurality of recovery options comprising a suggested restore point identifying, based on the infection time and the buffer time, a restore time to which changes to the one or more compromised server-stored files are reverted; transmitting a recovery notification to the client device, the recovery notification indicating the plurality of recovery options; and receiving a user-selected restore point from a client storage application of the client device; providing said user-selected restore point to a server storage application within the cloud storage server which restores the cloud storage account at the user-selected restore point. accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device; determining that one or more compromised server-stored files from the plurality of server-stored files are affected by a malware activity; identifying an infection time at which the one or more compromised server-stored files became affected by the malware activity; computing a buffer time based on previously selected cloud storage server restore times relative to corresponding previously suggested restore points, wherein the buffer time is added or reduced to the restore time of the detected malware activity to ensure a safe restore time; determining a plurality of recovery options based on an identification of the one or more compromised server-stored files and the infection time at which the one or more compromised server-stored files became affected by the malware activity, the plurality of recovery options comprising a suggested restore point identifying, based on the infection time and the buffer time, a restore time to which changes to the one or more compromised server-stored files are reverted; transmitting a recovery notification to the client device, the recovery notification indicating the plurality of recovery options; and receiving a user-selected restore point from a client storage application of the client device; providing said user-selected restore point to a server storage application within the cloud storage server which restores the cloud storage account at the user-selected restore point.