A method for processing information securely, the method comprising: partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains; isolating and/or securing the domains in time and/or space from each other such that loss of security in one of the guest operating system virtual machine protection domains is isolated to the one lost security domain such that security is not broken in all the domains; hosting the plurality of guest operating system virtual machine protection domains by the separation kernel hypervisor; providing a dedicated virtualization assistance layer, VAL, including a virtual representation of the hardware platform in each guest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor; upon detection of suspect code execution by the guest operation system, securely transition execution to the defense mechanism within the virtualization assistance layer in a manner isolated from the guest operating system; analyzing, via the defense mechanisms, a behavior of the guest operating system for making a policy decision regarding the behavior; and hosting at least one defense mechanism, each which may be different from each other, that executes within one or more of the plurality of guest operating system virtual machine protection domains via the separation kernel hypervisor; whereby the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and the guest operating system, the virtualization assistance layer and the defense mechanism are provided in the guest operating system virtual machine protection domains rather than in the separation kernel hypervisor. partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains; isolating and/or securing the domains in time and/or space from each other such that loss of security in one of the guest operating system virtual machine protection domains is isolated to the one lost security domain such that security is not broken in all the domains; hosting the plurality of guest operating system virtual machine protection domains by the separation kernel hypervisor; providing a dedicated virtualization assistance layer, VAL, including a virtual representation of the hardware platform in each guest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor; upon detection of suspect code execution by the guest operation system, securely transition execution to the defense mechanism within the virtualization assistance layer in a manner isolated from the guest operating system; analyzing, via the defense mechanisms, a behavior of the guest operating system for making a policy decision regarding the behavior; and hosting at least one defense mechanism, each which may be different from each other, that executes within one or more of the plurality of guest operating system virtual machine protection domains via the separation kernel hypervisor; whereby the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and the guest operating system, the virtualization assistance layer and the defense mechanism are provided in the guest operating system virtual machine protection domains rather than in the separation kernel hypervisor.