Introspection is the use of hypervisor- and virtual machine monitor (VMM)-level APIs to expose low-level system information from all virtual machines (VMs) hosted by the VMM. The APIs can enable security and management capabilities that span multiple VMs without requiring the installation of an agent on each, without requiring virtual network reconfiguration and with potentially better performance than agents running in a separate VM. Introspection also provides separation of the security policy enforcement from the container it is protecting.