1. A method comprising: monitoring, by a dedicated security virtual machine (SVM) executing by a computing system, a file open event to access a file by a guest virtual machine (GVM) executing by the computing system; identifying a source associated with the file open event, wherein the source is an application or a device being used by the GVM; determining when a data loss prevention (DLP) policy requires monitoring of the source in view of a source control policy; monitoring the source for file system events associated with the file when the DLP policy requires monitoring; determining when the file violates the DLP policy in view of the source of the file system events; enforcing a first response rule associated with the GVM when the source associated with the file open event is a non-approved source per the source control policy; and enforcing a second response rule associated with the GVM when the file violates the DLP policy.