A system, comprising: a process operating in a general operating environment of the system; and an isolated environment comprising: a protection module to: modify the behavior of the process by modifying data associated with the process while the process is in operation to cause a behavior change in the process; verify whether the process has changed in accordance with the modification; and take a remedial action when the process fails to exhibit the behavior change; wherein the protection module modifies the data associated with the process by altering in memory executable instructions of the process; and wherein the executable instructions are modified by at least one of: altering a Boolean value in memory to trigger whether a function of the process executes; overwriting null operation instructions in the executable instructions associated with the process with instructions that call specific functions, where the null operation instructions were inserted in the process at compile time by a specially configured compiler; overwriting a function call in the executable instructions to trigger an alternative function call; and altering a function pointer in memory. a process operating in a general operating environment of the system; and an isolated environment comprising: a protection module to: modify the behavior of the process by modifying data associated with the process while the process is in operation to cause a behavior change in the process; verify whether the process has changed in accordance with the modification; and take a remedial action when the process fails to exhibit the behavior change; wherein the protection module modifies the data associated with the process by altering in memory executable instructions of the process; and wherein the executable instructions are modified by at least one of: altering a Boolean value in memory to trigger whether a function of the process executes; overwriting null operation instructions in the executable instructions associated with the process with instructions that call specific functions, where the null operation instructions were inserted in the process at compile time by a specially configured compiler; overwriting a function call in the executable instructions to trigger an alternative function call; and altering a function pointer in memory. modify the behavior of the process by modifying data associated with the process while the process is in operation to cause a behavior change in the process; verify whether the process has changed in accordance with the modification; and take a remedial action when the process fails to exhibit the behavior change; wherein the protection module modifies the data associated with the process by altering in memory executable instructions of the process; and wherein the executable instructions are modified by at least one of: altering a Boolean value in memory to trigger whether a function of the process executes; overwriting null operation instructions in the executable instructions associated with the process with instructions that call specific functions, where the null operation instructions were inserted in the process at compile time by a specially configured compiler; overwriting a function call in the executable instructions to trigger an alternative function call; and altering a function pointer in memory. altering a Boolean value in memory to trigger whether a function of the process executes; overwriting null operation instructions in the executable instructions associated with the process with instructions that call specific functions, where the null operation instructions were inserted in the process at compile time by a specially configured compiler; overwriting a function call in the executable instructions to trigger an alternative function call; and altering a function pointer in memory.