Multilevel virtual machines for secure testing of protected networks

A method comprising:

• establishing a first network connection between a test network server and a protected network, the protected network including a protected network server and a plurality of protected network computers, the protected network server and the protected network computers in network communication with each other;
• establishing a second network connection between the test network server and a plurality of test network computers;
• running a first virtual machine on a first test network computer;
• running a virtual server on the test network server, the virtual server configured to convert each protected network computer into second virtual machine files, the second virtual machine files readable by the first virtual machine;
• running a second virtual machine on the first virtual machine using the second virtual machine files for a specific protected network computer;
• establishing a virtual network connection between (a) the first virtual machine and the second virtual machine and (b) and the virtual server;
• monitoring, with the first virtual machine, the test network computer and/or the first virtual machine for a predetermined test event;
• and
• when the predetermined test event occurs:
• automatically disabling the virtual network connection to isolate the first and second virtual machines from the virtual server, the test network server, and the protected network in a secure test bubble, and
• performing a secure service with the second virtual machine while the first and second virtual machines are in the secure test bubble.