1. A computer-implemented method, comprising: for a computer system implemented using compute capacity of hardware of a service of a service provider, receiving, from a customer of the service provider, a request to monitor the computer system of a customer of the service provider; and using the compute capacity to launch a monitoring agent in an enclave on the hardware of the service provider, the enclave being a protected execution environment in memory address space of the computer system that provides confidentiality and integrity for applications and data in the memory address space, wherein the protected execution environment provides functionality for remote attestation as to a state of the protected execution environment, has a root of trust protected from being accessed outside the protected execution environment, and prevents unauthorized access to the monitoring agent, such that the monitoring agent is operable to: generate an assessment of a state of the computer system, and provide the assessment of the state of the computer system.