What Is a Hypervisor?

A hypervisor is the software, firmware, or specialized control layer that creates and runs virtual machines (VMs) on a physical system. In simple terms, a hypervisor lets one physical computer run multiple isolated guest operating systems at the same time. That makes virtualization possible by sharing CPU, memory, storage, and networking resources across separate virtual machines without treating them as one combined system.

How a hypervisor works#

Without virtualization, one physical server usually runs one operating system directly on the hardware. A hypervisor changes that model by sitting between the hardware and the workloads, or on top of a host operating system, depending on the architecture.

Its job is to manage and divide core resources such as:

• CPU
• Memory
• Storage
• Networking
• Device access

Each virtual machine gets a defined portion of those resources and runs its own guest operating system as if it were a standalone system.

Resource abstraction

The hypervisor presents virtual hardware to each VM. A guest operating system believes it has its own CPU, RAM, disks, and network interfaces, even though those are really shared resources from the host.

This abstraction is what allows teams to run, for example:

• A Linux server VM
• A Windows server VM
• A testing appliance VM

all on the same physical machine.

Isolation between virtual machines

A key function of the hypervisor is isolation. One VM should not be able to freely access another VM’s memory, files, or processes unless there is an intended connection through networking or shared configuration.

That isolation is one reason virtualization is useful both operationally and from a security perspective. It allows organizations to separate workloads, environments, and trust levels more cleanly than running everything in one operating system.

Scheduling and control

The hypervisor also decides how physical resources are assigned over time. If several VMs need CPU at once, the hypervisor schedules that access. If one VM needs more memory or a new virtual disk, the hypervisor manages that too.

In enterprise environments, this often includes features like:

• Snapshots
• Live migration
• High availability
• Resource pools
• Template-based VM deployment

Main types of hypervisors#

Hypervisors are usually grouped into two categories.

Type 1 hypervisor

A Type 1 hypervisor runs directly on the physical hardware. It does not depend on a general-purpose host operating system underneath it.

This is often called a bare-metal hypervisor.

Type 1 hypervisors are common in:

• Data centers
• Private cloud environments
• Enterprise server virtualization
• Production infrastructure

Because they run closer to the hardware, they are generally preferred for performance, control, and large-scale administration.

Type 2 hypervisor

A Type 2 hypervisor runs on top of a standard operating system such as Windows, Linux, or macOS. In this model, the host operating system is installed first, and the hypervisor runs as an application or service within it.

Type 2 hypervisors are common in:

• Desktop labs
• Software testing
• Training environments
• Individual developer systems

They are often simpler for local use, but they add another software layer between the VM and the hardware.

Why hypervisors matter in security#

From a security standpoint, the hypervisor is a high-value control point because it sits underneath or between many workloads.

If you secure it well, you improve the security of the virtual environment as a whole. If you manage it poorly, one weak point can affect multiple systems at once.

Reduced hardware sprawl, concentrated risk

Virtualization reduces the number of physical systems you need, but it also concentrates workloads onto shared infrastructure. That means compromise of the hypervisor, its management plane, or its administrative accounts can have broad impact.

Segmentation and containment benefits

Used properly, hypervisors can support stronger isolation between workloads. Teams may separate production, development, and test systems into different VM groups or networks. That can help contain faults and reduce accidental exposure.

Management-plane security matters

In many environments, the bigger practical risk is not a “hypervisor hack” in the abstract, but weak controls around:

• Administrative access
• Patch management
• VM sprawl
• Snapshot handling
• Backup security
• Management network exposure

The hypervisor layer is powerful, so access to it should be tightly controlled and monitored.

Common hypervisor use cases#

Hypervisors appear in many everyday IT and security scenarios.

Server consolidation

Organizations use virtualization to run many workloads on fewer physical systems, which reduces hardware costs and improves operational flexibility.

Test and lab environments

Admins, engineers, and students often create isolated VMs for testing software, simulating networks, or practicing system administration without affecting a production machine.

Security analysis and sandboxing

Researchers and defenders frequently analyze suspicious files and malware in virtual machines. If you want more background on malware behavior in those environments, see what is malware.

Business continuity and recovery

Because VMs are software-defined, they are often easier to snapshot, replicate, and restore than traditional physical servers. That makes virtualization a common part of disaster recovery planning.

When you’ll encounter the term hypervisor#

You will encounter the term hypervisor anywhere virtualization is in use.

In server and data center operations

Most IT teams dealing with on-prem infrastructure use hypervisors to consolidate servers and run multiple services on fewer physical hosts.

In cloud and private cloud discussions

Virtualization is foundational to many cloud models. Even when the customer does not directly manage the hypervisor, the concept is still central to how compute resources are delivered and isolated.

In security architecture reviews

Security teams review hypervisors when assessing segmentation, privileged access, patching, workload isolation, and disaster recovery design. For related architecture principles, see what is defense in depth.

In malware and threat analysis

Some advanced malware checks whether it is running inside a VM to evade analysis. Separately, defenders often use virtual machines in sandboxes and research labs, which means the hypervisor becomes part of the security tooling environment.

In desktop testing and training labs

Admins, developers, and students often use local virtualization software to run multiple operating systems on one workstation. In these cases, they are interacting with a Type 2 hypervisor even if they do not use the term daily.

Tools that often support virtual environments#

Teams that manage virtual infrastructure also tend to care about secure administrator access and endpoint protection on management systems. A password manager like 1Password can help secure admin credentials used across virtualization platforms, and endpoint protection such as Malwarebytes may add protection on administrator workstations that access hypervisor consoles.

These tools do not replace hypervisor security controls, but they can support the broader operational environment around VM management.

Bottom line#

A hypervisor is the layer that makes virtual machines possible. It divides physical hardware into multiple isolated computing environments, allowing organizations to run more efficiently and manage infrastructure more flexibly. In security terms, it is both an enabler of isolation and a critical control point that needs strong administrative protection.