Type 1 (bare-metal, more secure): VMware ESXi, Hyper-V, Xen. Type 2 (hosted, less secure): VirtualBox, VMware Workstation. VM escape = guest breaks out to host.
Type 1 hypervisors run directly on hardware — smaller attack surface. VM escape exploits are rare but catastrophic. Patch hypervisors immediately when vulnerabilities are published. Multi-tenant cloud relies on hypervisor isolation between customers.