A method for providing security on a controller, the method comprising: launching, by the controller, a kernel-level security layer that includes a whitelist of permitted processes on the controller, the whitelist being part of a custom security policy for the controller, wherein one or more hooks are registered for one or more kernel level processes on the controller, the hooks configured to cause calls to the one or more kernel level processes to be redirected to the security layer with (i) process information identifying a kernel level process being called and (ii) a pointer to the called process in memory; receiving, at the security level of the controller, a request to run a particular process; redirecting the request to run the particular process in the security layer using a corresponding hook function of the one or more registered hooks; determining, by the hook function of the security layer, using a pointer of the particular process in the memory, a signature for a current state of the particular process; identifying, by the hook function of the security layer, a verified signature for the particular process from the whitelist using particular process information identifying the particular process; determining, by the hook function of the security layer, whether the current state of the particular process is permitted to be run on the controller based on a comparison of the determined signature with the verified signature from the whitelist; and blocking, by the security layer, the particular process from running on the controller based on the determined signature not matching the verified signature for the process. launching, by the controller, a kernel-level security layer that includes a whitelist of permitted processes on the controller, the whitelist being part of a custom security policy for the controller, wherein one or more hooks are registered for one or more kernel level processes on the controller, the hooks configured to cause calls to the one or more kernel level processes to be redirected to the security layer with (i) process information identifying a kernel level process being called and (ii) a pointer to the called process in memory; receiving, at the security level of the controller, a request to run a particular process; redirecting the request to run the particular process in the security layer using a corresponding hook function of the one or more registered hooks; determining, by the hook function of the security layer, using a pointer of the particular process in the memory, a signature for a current state of the particular process; identifying, by the hook function of the security layer, a verified signature for the particular process from the whitelist using particular process information identifying the particular process; determining, by the hook function of the security layer, whether the current state of the particular process is permitted to be run on the controller based on a comparison of the determined signature with the verified signature from the whitelist; and blocking, by the security layer, the particular process from running on the controller based on the determined signature not matching the verified signature for the process.