1. A computer-implemented method, comprising: provisioning a guest operating system having non-virtualized access to at least one device of a host system; causing a counter to be updated for at least one attempted modification of configuration information for the at least one device; determining that a value of the counter does not correspond to an expected value; and performing at least one security action with respect to at least one of the host system or the at least one device, wherein the expected value is stored in a location inaccessible to the guest operating system.