A MicroVM is a lightweight virtual machine built to isolate workloads with less overhead than a traditional VM. It keeps the guest environment small by limiting emulated hardware and trimming unnecessary components, which can improve startup speed and density while still preserving a stronger boundary than a simple process sandbox.
In cyber security, MicroVMs matter because they are often used to contain untrusted code, browser tasks, serverless jobs, or challenge environments. Their security depends heavily on the guest kernel and the hypervisor: a kernel flaw may enable privilege escalation inside the guest, and a hypervisor flaw can threaten escape into the host. Defenders use MicroVMs with hardening, syscall filtering, and patch discipline to reduce blast radius, while attackers look for bugs that cross the isolation boundary.