diff --git a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts
index f0c397e93ac4e..1d3f3782d482a 100644
--- a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts
@@ -170,6 +170,57 @@ describe('7.14.0 Endpoint Package Policy migration', () => {
     expect(migration(initialDoc, {} as SavedObjectMigrationContext)).toEqual(migratedDoc);
   });
 
+  it('adds supported option for ransomware on migrations and linux malware option and notification customization when ransomware is malformed', () => {
+    const initialDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'on' } },
+      windowsRansomware: { ransomware: 'off' },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          ransomware: {
+            message: '',
+            enabled: true,
+          },
+        },
+      },
+    });
+
+    const migratedDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'on' } },
+      windowsRansomware: { ransomware: { mode: 'off', supported: true } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          ransomware: {
+            message: '',
+            enabled: true,
+          },
+        },
+      },
+      linuxMalware: {
+        malware: {
+          mode: 'on',
+        },
+      },
+      linuxPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+        },
+      },
+    });
+
+    expect(migration(initialDoc, {} as SavedObjectMigrationContext)).toEqual(migratedDoc);
+  });
+
   it('does not modify non-endpoint package policies', () => {
     const doc: SavedObjectUnsanitizedDoc<PackagePolicy> = {
       id: 'mock-saved-object-id',
diff --git a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.ts b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.ts
index cd7dcc2d3e1df..2f281bcf86a95 100644
--- a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.ts
@@ -31,7 +31,11 @@ export const migrateEndpointPackagePolicyToV7140: SavedObjectMigrationFn<
 
       // This value is based on license.
       // For the migration, we add 'true', our license watcher will correct it, if needed, when the app starts.
-      policy.windows.ransomware.supported = true;
+      if (policy?.windows?.ransomware?.mode) {
+        policy.windows.ransomware.supported = true;
+      } else {
+        policy.windows.ransomware = { mode: 'off', supported: true };
+      }
     }
   }