I sometimes use Qubes and I find it very useful for securing individual workstations. You can run applications such as a browser in disposable VMs. A vulnerabil

I sometimes use Qubes and I find it very useful for securing individual workstations. You can run applications such as a browser in disposable VMs. A vulnerability in the application doesn’t compromise most of the system. Different components such as networking or USB run in isolated environments. That’s segmentation part of the NIST advice (at OS level, not network). It’s especially useful against targeted attacks, that often rely on the zero day exploits. As far as I know, it’s very difficult to chain two vulnerabilities, one in the browser and one in the Xen hypervisor to escape the hypervisor security boundary. There are also a host of other security features, such as air gapping some of data, built in support for Whonix (probably the most secure way to access the Tor network), Gpg Qube, etc. Qubes-OS is usable, although it has to be made more user friendly. You can organize your digital content in isolated “computers” which simplifies your setup. Like, one VM for each project or client. Highly recommended! Another thing: the OS is not backed by a company. You have to trust independent developers (but they are known publicly), in addition to Debian or Fedora developers.