Qubes OS

Qubes OS takes 'security through compartmentalization' as its entire architecture: rather than trusting one shared kernel and filesystem for everything, each qube is its own lightweight Xen virtual machine, so a compromised browser tab or malicious PDF viewer is trapped inside its own qube instead of reaching your files, passwords, or other applications. Different qubes can be assigned different trust levels and even different network routes (a 'sys-whonix' qube routes traffic through Tor automatically, for instance), letting a user keep work, banking, and untrusted browsing fully separated on the same physical laptop. It has a steeper learning curve and higher hardware requirements than a typical distribution, but it's endorsed and used by figures like Edward Snowden specifically for its threat model against sophisticated, targeted attacks.