The networking architecture provided by VT-d gives a higher level of protection from
malicious network traffic by creating the ability to isolate malicious
attacks to a single VM and it's associated resources assigned through the use of VT
and VT-d. Using this VT-d allows gives a foundation for a new class of applications based on
Virtual Appliance architecture. Because of the isolation of the NIC device, all VM accesses to the NIC device are intercepted and emulated to
protect proliferation of malicious code, an attack on a VM does not affect the VMM.

For instance use of NAT (Network Address Translation) is discourtaged from some "hosted" VMMs because an attack on the "guest" VM can affect the host.