At Bromium we do complete task isolation in uVMs and use monitoring to watch what happens inside. Most customer infections we see come from ads, and they're mostly cryptoransomware. It's absurd.