Because traffic across the hardware backplane escapes traditional network tools, VM-specific mechanisms such as host firewalls on virtual machines and virtual networks and firewalls at the hypervisor layer give granular monitoring of traffic crossing the backplane; least privilege governs communication between virtual machines through tight host firewall rules and disabled unnecessary protocols; firewalls or intrusion detection at hypervisor, network and host level are chosen to fit business need, configured with stringent rules and kept portable when a virtual machine moves; and ports, services and virtual hardware that are not needed (USB, inter-VM clipboard, spare virtual network adapters) are disabled so machines stay logically isolated if one is compromised. Remote access to the VM management console is restricted to authorised staff.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.