Each threat vector, such as rendering a particular website or opening a particular document, is isolated at the hardware layer in its own container (micro-VM), isolated from the underlying system, network and other websites and documents open (for more information check out the vSentry whitepaper).