A method for processing information securely, the method comprising: partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains; isolating and/or securing the domains in time and/or space from each other such that loss of security in one of the guest operating system virtual machine protection domains is isolated to the one lost security domain such that security is not broken in all the domains; hosting the plurality of guest operating system virtual machine protection domains by the separation kernel hypervisor; providing a dedicated virtualization assistance layer, VAL, including a virtual representation of the hardware platform in each guest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor; hosting, by the separation kernel hypervisor, a malicious code defense mechanisms which executes within the virtual hardware platform in each of the plurality of guest operating system virtual machine protection domains, the malicious code defense mechanisms being isolated from the malicious code having high temporal and spatial locality to the malicious code and thereby being proximate to the malicious code, but incorruptible and unaffected by the malicious code; upon detection of malicious code execution by the guest operation system, securely transition execution to the malicious code defense mechanism within the virtualization assistance layer in a manner isolated from the guest operating system; analyzing, via the malicious code defense mechanisms, a behavior of the guest operating system for making a policy decision regarding the behavior; transition execution back to the separation kernel hypervisor for taking action on the policy decision; and hosting at least one malicious code defense mechanism, each which may be different from each other, that executes within one or more of the plurality of guest operating system virtual machine protection domains via the separation kernel hypervisor; whereby the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and the guest operating system, the virtualization assistance layer and the malicious code defense mechanism are provided in the guest operating system virtual machine protection domains rather than in the separation kernel hypervisor. partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains; isolating and/or securing the domains in time and/or space from each other such that loss of security in one of the guest operating system virtual machine protection domains is isolated to the one lost security domain such that security is not broken in all the domains; hosting the plurality of guest operating system virtual machine protection domains by the separation kernel hypervisor; providing a dedicated virtualization assistance layer, VAL, including a virtual representation of the hardware platform in each guest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor; hosting, by the separation kernel hypervisor, a malicious code defense mechanisms which executes within the virtual hardware platform in each of the plurality of guest operating system virtual machine protection domains, the malicious code defense mechanisms being isolated from the malicious code having high temporal and spatial locality to the malicious code and thereby being proximate to the malicious code, but incorruptible and unaffected by the malicious code; upon detection of malicious code execution by the guest operation system, securely transition execution to the malicious code defense mechanism within the virtualization assistance layer in a manner isolated from the guest operating system; analyzing, via the malicious code defense mechanisms, a behavior of the guest operating system for making a policy decision regarding the behavior; transition execution back to the separation kernel hypervisor for taking action on the policy decision; and hosting at least one malicious code defense mechanism, each which may be different from each other, that executes within one or more of the plurality of guest operating system virtual machine protection domains via the separation kernel hypervisor; whereby the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and the guest operating system, the virtualization assistance layer and the malicious code defense mechanism are provided in the guest operating system virtual machine protection domains rather than in the separation kernel hypervisor.