Abstract: A distributed data security event detection and response (DDSEDR) system includes a data security management (DSM) system and a client-side data security event confirmation and response (CDSECR) system that manage data security events, such as ransomware attacks. In at least one embodiment, the DDSEDR system provides data security event detection, confirmation, mitigation, alerting, and recovery from malicious processes and other data security events. In at least one embodiment, the DSM system monitors one or more client file event records for information that indicates a potential data security event. If the DSM system detects a potential data security threat, the DSM, sends information to the CDSECR system that causes CDSECR system to inspect one or more files associated with the potential data security event to determine whether an actual data security event occurred and initiate a responsive action when the CDSECR system detects an actual data security event.