the problem is that for a security scanner to scan threats properly, they need to sit on the kernel, there should be a mode where they allow scanners to read but is not able to crash the system. Some sort of sand box for all these kernel access