1. A method comprising: establishing a security container in a software-defined environment, the security container describing a workload and a set of resources, the set of resources being required by the workload; determining a set of resource-divisible portions of the workload including a compute-resource portion, a storage resource portion, and a network resource portion; generating a plurality of sub-containers within the security container, a sub-container within the plurality of sub-containers representing only one resource-divisible portion of the workload; determining a set of security criteria for the security container; monitoring the workload and the set of resources for security events based, at least in part, upon the set of security criteria; and responsive to identifying a security event, adjusting one or more security mechanisms; wherein: the plurality of sub-containers represent an end-to-end run time environment for processing the workload; the end-to-end run time environment includes bare metal sub-containers and hypervisor-specific sub-containers; the set of resources are software abstractions; and at least the steps of monitoring and adjusting are operated within the software-defined environment.