A system for hypervisor assisted intrusion and extrusion detection comprising: at least one processor; and at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for hypervisor assisted intrusion and extrusion detection, the process for hypervisor assisted intrusion and extrusion detection including: providing a hypervisor, the hypervisor controlling a virtual asset; providing an analysis trigger monitoring system in the hypervisor; defining one or more analysis trigger parameters; generating analysis trigger data representing the analysis trigger parameters; providing the analysis trigger data to the analysis trigger monitoring system; using the analysis trigger monitoring system and the analysis trigger data to monitor at least a portion of the message traffic sent to, and/or sent from, the virtual asset controlled by the hypervisor to detect any message including one or more of the one or more analysis trigger parameters, wherein all message traffic sent to, and/or sent from, the virtual asset is relayed by the hypervisor using a first communications channel; classifying any detected message including one or more of the one or more analysis trigger parameters as a suspect message; for each suspect message generating suspect message copy data representing a copy of at least a portion of the suspect message; and transferring the suspect message copy data to one or more analysis systems for further analysis, wherein the suspect message copy data is transferred to the analysis system for further analysis through an analysis communications channel that is distinct from the first communications channel. at least one processor; and at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for hypervisor assisted intrusion and extrusion detection, the process for hypervisor assisted intrusion and extrusion detection including: providing a hypervisor, the hypervisor controlling a virtual asset; providing an analysis trigger monitoring system in the hypervisor; defining one or more analysis trigger parameters; generating analysis trigger data representing the analysis trigger parameters; providing the analysis trigger data to the analysis trigger monitoring system; using the analysis trigger monitoring system and the analysis trigger data to monitor at least a portion of the message traffic sent to, and/or sent from, the virtual asset controlled by the hypervisor to detect any message including one or more of the one or more analysis trigger parameters, wherein all message traffic sent to, and/or sent from, the virtual asset is relayed by the hypervisor using a first communications channel; classifying any detected message including one or more of the one or more analysis trigger parameters as a suspect message; for each suspect message generating suspect message copy data representing a copy of at least a portion of the suspect message; and transferring the suspect message copy data to one or more analysis systems for further analysis, wherein the suspect message copy data is transferred to the analysis system for further analysis through an analysis communications channel that is distinct from the first communications channel. providing a hypervisor, the hypervisor controlling a virtual asset; providing an analysis trigger monitoring system in the hypervisor; defining one or more analysis trigger parameters; generating analysis trigger data representing the analysis trigger parameters; providing the analysis trigger data to the analysis trigger monitoring system; using the analysis trigger monitoring system and the analysis trigger data to monitor at least a portion of the message traffic sent to, and/or sent from, the virtual asset controlled by the hypervisor to detect any message including one or more of the one or more analysis trigger parameters, wherein all message traffic sent to, and/or sent from, the virtual asset is relayed by the hypervisor using a first communications channel; classifying any detected message including one or more of the one or more analysis trigger parameters as a suspect message; for each suspect message generating suspect message copy data representing a copy of at least a portion of the suspect message; and transferring the suspect message copy data to one or more analysis systems for further analysis, wherein the suspect message copy data is transferred to the analysis system for further analysis through an analysis communications channel that is distinct from the first communications channel.