1. A computer system, comprising: one or more processors each having one or more processor cores organized as one or more virtual machines; one or more virtual network interfaces coupled to any of the processors, cores, or virtual machines and to one or more networks; memory coupled to any of the one or more processors, cores or virtual machines and comprising at least one controlled execution space hosting an operating system and an application program; a vulnerability monitoring agent coupled to the controlled execution space; one or more vulnerability profiles coupled to the vulnerability monitoring agent, wherein each of the vulnerability profiles comprises an application program identifier, an operating system identifier, a vulnerability specification describing a vulnerability of an application program that the application program identifier indicates when executed with an operating system that the operating system identifier indicates, and a remedial action which when executed will remediate the vulnerability; wherein the vulnerability monitoring agent is configured to monitor execution of the operating system and the application program in the controlled execution space, to detect an anomaly associated with the vulnerability during the execution, to determine the remedial action for the operating system and application program based on one of the vulnerability profiles, and to cause the remedial action.