> One indicator of a compromised device is a reduction in perceived performance. That doesn't work because of the hilariously wide performance swings induced b

> One indicator of a compromised device is a reduction in perceived performance. That doesn't work because of the hilariously wide performance swings induced by antivirus software overhead. :( IMHO the tab-isolation model you describe is the solution for the top-level comment - something something Firecracker...