A system comprising: one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: determining features of files in a storage account of a cloud storage server, the storage account registered with a client device; detecting ransomware activity based on the features of the files; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account; receiving, from the client device, a remediation option selected from the one or more remediation options; recovering one or more files in the storage account based on the selected remediation option; prior to detecting the ransomware activity, receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server; and performing the changes to the one or more files in the storage account of the cloud storage server. one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: determining features of files in a storage account of a cloud storage server, the storage account registered with a client device; detecting ransomware activity based on the features of the files; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account; receiving, from the client device, a remediation option selected from the one or more remediation options; recovering one or more files in the storage account based on the selected remediation option; prior to detecting the ransomware activity, receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server; and performing the changes to the one or more files in the storage account of the cloud storage server. determining features of files in a storage account of a cloud storage server, the storage account registered with a client device; detecting ransomware activity based on the features of the files; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account; receiving, from the client device, a remediation option selected from the one or more remediation options; recovering one or more files in the storage account based on the selected remediation option; prior to detecting the ransomware activity, receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server; and performing the changes to the one or more files in the storage account of the cloud storage server.