A method for information security management, comprising: identifying an anomaly in data traffic directed to a data processing environment , wherein the anomaly indicates a threat to the data processing environment and the data processing environment comprises a plurality of data processing systems ; identifying a threatened data processing system , wherein the threatened data processing system is one of the plurality of data processing systems to which the threat is directed; isolating the threatened data processing system ; monitoring and analyzing the threatened data processing system after isolating the threatened data processing system; and replicating the threatened data processing system to form a replicated data processing system directing a portion of the data traffic that is verified to have no anomalies to the replicated data processing system ; wherein the plurality of data processing systems comprises a host data processing system and a plurality of guest data processing systems associated with the host data processing system; the threatened data processing system is one of the plurality of guest data processing systems; the threatened data processing system is replicated to form a replicated guest data processing system associated with the host data processing system; the portion of the data traffic that is verified to have no anomalies is directed to the replicated guest data system; the threatened guest data processing system is moved to an isolation host data processing system ; data traffic is directed to the threatened guest data processing system after moving the threatened guest data processing system to the isolation host data processing system; and the threatened guest data processing system is monitored after moving the threatened guest data processing system to the isolation host data processing system. identifying an anomaly in data traffic directed to a data processing environment , wherein the anomaly indicates a threat to the data processing environment and the data processing environment comprises a plurality of data processing systems ; identifying a threatened data processing system , wherein the threatened data processing system is one of the plurality of data processing systems to which the threat is directed; isolating the threatened data processing system ; monitoring and analyzing the threatened data processing system after isolating the threatened data processing system; and replicating the threatened data processing system to form a replicated data processing system directing a portion of the data traffic that is verified to have no anomalies to the replicated data processing system ; wherein the plurality of data processing systems comprises a host data processing system and a plurality of guest data processing systems associated with the host data processing system; the threatened data processing system is one of the plurality of guest data processing systems; the threatened data processing system is replicated to form a replicated guest data processing system associated with the host data processing system; the portion of the data traffic that is verified to have no anomalies is directed to the replicated guest data system; the threatened guest data processing system is moved to an isolation host data processing system ; data traffic is directed to the threatened guest data processing system after moving the threatened guest data processing system to the isolation host data processing system; and the threatened guest data processing system is monitored after moving the threatened guest data processing system to the isolation host data processing system. <EOS>