An apparatus, comprising: a walker to traverse a paging structure of an address translation system; a bit analyzer to determine whether a bit associated with an entry of the paging structure is indicative of the entry being recently accessed; an address identifier to, when the bit analyzer determines that the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, determine an address associated with the entry; an scan target outputter to provide the determined address to a memory scanner for malware-indicative patterns, wherein at least one of the walker, the bit analyzer, the address identifier, or the scan target outputter is implemented via a logic circuit; characterized in a protection assignor to: determine a first protection domain under which a first one of the walker, the bit analyzer, the address identifier, the scan target outputter, or the memory scanner is to operate; and determine a second protection domain under which a second one of the walker, the bit analyzer, the address identifier, the scan target outputter, or the memory scanner is to operate; and a workload offloader to: select a first processing component to implement the first one of the walker, the bit analyzer, the scan target outputter, or the memory scanner; and select a second processing component different than the first processing component to implement the second one of the walker, the bit analyzer, the scan target outputter or the memory scanner. a walker to traverse a paging structure of an address translation system; a bit analyzer to determine whether a bit associated with an entry of the paging structure is indicative of the entry being recently accessed; an address identifier to, when the bit analyzer determines that the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, determine an address associated with the entry; an scan target outputter to provide the determined address to a memory scanner for malware-indicative patterns, wherein at least one of the walker, the bit analyzer, the address identifier, or the scan target outputter is implemented via a logic circuit; characterized in a protection assignor to: determine a first protection domain under which a first one of the walker, the bit analyzer, the address identifier, the scan target outputter, or the memory scanner is to operate; and determine a second protection domain under which a second one of the walker, the bit analyzer, the address identifier, the scan target outputter, or the memory scanner is to operate; and determine a first protection domain under which a first one of the walker, the bit analyzer, the address identifier, the scan target outputter, or the memory scanner is to operate; and determine a second protection domain under which a second one of the walker, the bit analyzer, the address identifier, the scan target outputter, or the memory scanner is to operate; and a workload offloader to: select a first processing component to implement the first one of the walker, the bit analyzer, the scan target outputter, or the memory scanner; and select a second processing component different than the first processing component to implement the second one of the walker, the bit analyzer, the scan target outputter or the memory scanner. select a first processing component to implement the first one of the walker, the bit analyzer, the scan target outputter, or the memory scanner; and select a second processing component different than the first processing component to implement the second one of the walker, the bit analyzer, the scan target outputter or the memory scanner.