1. A system comprising: a guest virtual machine comprising: one or more virtual machine measurement points implemented by one or more processors to operate in a kernel space of the guest virtual machine, and configured to collect virtual machine operating characteristics metadata from at least one of the kernel space of the guest virtual machine and a user space of the guest virtual machine; and a hypervisor control point implemented by the one or more processors to operate in the kernel space of the guest virtual machine, and configured to: receive virtual machine operating characteristics metadata from the virtual machine measurement points; and send the virtual machine operating characteristics metadata to a hypervisor associated with the guest virtual machine using a hypervisor connecting interface; the hypervisor configured to: receive the virtual machine operating characteristics metadata; and forward the virtual machine operating characteristics metadata to a hypervisor device driver of a virtual vault machine using a secure virtual network connection; and the virtual vault machine configured to: implement the hypervisor device driver in a kernel space of the virtual vault machine, wherein the hypervisor device driver is configured to send the virtual machine operating characteristics metadata to an analysis tool in a user space of the virtual vault machine; and determine a classification for the guest virtual machine based on the virtual machine operating characteristics metadata using the analysis tool, wherein the classification is one of a healthy state and a compromised state; and send the determined classification to a vault management console.