1. A method comprising: receiving, at an intermediary manager executing via a virtual machine on a computer, a particular request from a guest operating system located at the same virtual machine as the intermediary manager, wherein the intermediary manager acts as an intermediary between the guest operating system and a hypervisor that is separate from the intermediary manager by intercepting one or more requests made by the guest operating system and then effectuating the one or more requests by invoking the hypervisor; in response to receiving the particular request, determining whether the particular request meets a particular threat response trigger of a plurality of threat response triggers defined within a threat defense policy, wherein each threat response trigger of the plurality of threat response triggers defined within the threat defense policy has a corresponding remedial action; in response to the intermediary manager determining that the particular request meets the particular threat response trigger, the intermediary manager performing the corresponding remedial action of the particular threat response trigger; in response to the intermediary manager determining that the particular request meets none of the plurality of threat response triggers, the intermediary manager invoking the hypervisor to effectuate the particular request.