1. A method, comprising: synchronizing a first memory page set with a second memory page set of a virtual guest machine; inspecting the first memory page set off-line; detecting a threat in the first memory page set; and taking an action based on the threat.