[nickpsecurity]

The ones I've seen so far are both monolithic and hosted on drivers/kernel of something monolithic. That's probably the rule for now.