A client computer system comprising a hardware processor and a memory, the hardware processor configured to execute a hypervisor configured to expose a guest virtual machine and a security VM distinct from the guest VM, said processor being configured to further execute a live introspection engine and an on-demand introspection engine, wherein: the live introspection engine executes outside of the guest and security VMs, and wherein executing the live introspection engine comprises the hardware processor, in response to detecting an occurrence of an event within the guest VM, transmitting an indicator of the event to a remote server computer system over a communication network; and the on-demand introspection engine executes within the security VM, and wherein executing the on-demand introspection engine comprises carrying out the steps of: in response to the live introspection engine transmitting the indicator of the event to the remote server computer system, receiving an analysis request from the remote server computer system, the analysis request indicating a security tool residing in a remote tool repository configured to distribute security tools to a plurality of clients including the client computer system, the security tool comprising software configured to analyze the occurrence of the event, the security tool selected by the remote server computer system according to an event type of the event, in response to receiving the analysis request, identifying the security tool according to the analysis request, in response to identifying the security tool, selectively retrieving the security tool from the tool repository, wherein retrieving the security tool comprises connecting to the central tool repository over the communication network, in response to selectively retrieving the security tool, executing the security tool, and in response to executing the security tool, transmitting a result of executing the security tool to the remote server computer system. the live introspection engine executes outside of the guest and security VMs, and wherein executing the live introspection engine comprises the hardware processor, in response to detecting an occurrence of an event within the guest VM, transmitting an indicator of the event to a remote server computer system over a communication network; and the on-demand introspection engine executes within the security VM, and wherein executing the on-demand introspection engine comprises carrying out the steps of: in response to the live introspection engine transmitting the indicator of the event to the remote server computer system, receiving an analysis request from the remote server computer system, the analysis request indicating a security tool residing in a remote tool repository configured to distribute security tools to a plurality of clients including the client computer system, the security tool comprising software configured to analyze the occurrence of the event, the security tool selected by the remote server computer system according to an event type of the event, in response to receiving the analysis request, identifying the security tool according to the analysis request, in response to identifying the security tool, selectively retrieving the security tool from the tool repository, wherein retrieving the security tool comprises connecting to the central tool repository over the communication network, in response to selectively retrieving the security tool, executing the security tool, and in response to executing the security tool, transmitting a result of executing the security tool to the remote server computer system. in response to the live introspection engine transmitting the indicator of the event to the remote server computer system, receiving an analysis request from the remote server computer system, the analysis request indicating a security tool residing in a remote tool repository configured to distribute security tools to a plurality of clients including the client computer system, the security tool comprising software configured to analyze the occurrence of the event, the security tool selected by the remote server computer system according to an event type of the event, in response to receiving the analysis request, identifying the security tool according to the analysis request, in response to identifying the security tool, selectively retrieving the security tool from the tool repository, wherein retrieving the security tool comprises connecting to the central tool repository over the communication network, in response to selectively retrieving the security tool, executing the security tool, and in response to executing the security tool, transmitting a result of executing the security tool to the remote server computer system.