VM

What is a VM (Virtual Machine)?

A Virtual Machine (VM) is a software-based computer with its own virtual CPU, memory, disks and network adapters that runs on a physical host by means of a hypervisor, sharing that host’s hardware with other virtual machines. A VM boots its own operating system, such as Windows Server or Linux, and behaves like an ordinary computer for the software inside it. In OT and industrial environments, VMs are mainly used to consolidate SCADA servers, historians, engineering stations and MES systems, recover them faster and manage them more effectively.

🧠 How does a VM work?

A VM consists of three layers:

1. Hypervisor layer - the hypervisor divides the physical hardware among the VMs and keeps them separated. A Type 1 (bare-metal) hypervisor runs directly on the server, for example VMware ESXi, Microsoft Hyper-V, KVM or Proxmox VE. A Type 2 hypervisor such as VirtualBox or VMware Workstation runs on top of a regular operating system and suits test and engineering work on a laptop.
2. Virtual hardware - each VM gets virtual CPUs (vCPUs), RAM, virtual disks and virtual network adapters, which can be sized per VM to the needs of the system.
3. Guest operating system - inside the VM runs a complete operating system with its applications. A crash or infection in one VM does not, in principle, affect the other VMs on the same host.

The theoretical foundation dates from 1974, when Popek and Goldberg formulated the requirements a processor must meet to be virtualised efficiently. IBM already offered virtual machines on mainframes in 1972 with VM/370. On x86 servers, virtualisation only became truly efficient with hardware support in the processor: Intel VT-x (2005) and AMD-V (2006).

Because a VM is essentially a set of files (configuration plus virtual disks), it can be copied, backed up, moved and restored like ordinary files. That makes taking a Snapshot before a change, or cloning a complete test environment, straightforward.

🔄 What is the difference between a VM, a container and a physical server?

Containers are lighter, but they share the host kernel. For classic Windows-based OT software that expects a full operating system, the VM remains the usual choice. More on the underlying technology is in Virtualization.

🏭 Where are VMs used in industrial environments?

• Supervision and data - SCADA servers, HMI servers, Historian, MES and batch control
• Engineering - engineering stations with PLC software per project or per software version, so older projects stay editable with the right tool version
• Infrastructure - domain controllers and Active Directory in the OT segment, licence servers, jump servers for remote access
• Management - Backup servers, patch management platforms and Monitoring tools
• Test and simulation - staging environments for PLC and HMI changes and virtual commissioning against a digital process model
• Control - increasingly the control logic itself runs virtually as a Soft PLC. In 2023 Siemens showed the SIMATIC S7-1500V, a virtual PLC deployed as an Industrial Edge app

The biggest benefit in OT is lifespan: a Windows application tied to an outdated operating system can keep running as a VM on new hardware. That does not solve the underlying problem of legacy systems, but it makes it manageable.

🔧 How do you virtualise an OT environment in practice?

1. Inventory and classify - decide for each system in the asset inventory whether it is suitable. Systems with hard real-time requirements, special plug-in cards or USB dongles need extra attention or stay physical.
2. Check vendor support - DCS and SCADA vendors publish which hypervisors and versions they support. An unsupported combination can lead to a refusal of support during an outage.
3. Design for availability - at least two hosts (N+1) with shared or replicated storage. With HA, a VM automatically restarts on another host after a host failure; the interruption is then the detection time plus the boot time of the VM. Fault Tolerance keeps a shadow VM running in lockstep for near-zero interruption, but doubles the resources required.
4. Reserve resources - give critical VMs guaranteed CPU and memory reservations and avoid memory overcommitment, so a heavy report on the historian does not slow down the SCADA server.
5. Separate networks - use separate virtual switches or VLANs for management, storage, live migration and the process network, and follow the zones of the Purdue Model.
6. Arrange recovery - define an RTO and RPO for each VM and test restoring backups as part of disaster recovery.

🔐 How do you secure VMs and the hypervisor?

Virtualisation increases the attack surface if management is not properly controlled: whoever owns the hypervisor or the management console owns every VM at once. Isolation between VMs is strong but not absolute. In March 2025 Broadcom fixed three actively exploited ESXi vulnerabilities with VMSA-2025-0004, including CVE-2025-22224, which allowed an attacker with administrator rights inside a VM to execute code as the VMX process on the host. In early 2023 the ESXiArgs campaign encrypted more than 3,800 unpatched ESXi servers worldwide.

Measures per layer:

• Hypervisor and management - Hardening of the host, management interfaces reachable only from a separate management network, no joining of the management console to the office domain, and timely patching of the hypervisor
• Access - RBAC and access control for administrators, with multi-factor authentication and separate accounts for hypervisor management and OT applications
• Network - segment traffic between VMs with VLAN, virtual switches or microsegmentation, and place a Firewall between zones instead of putting everything on one flat virtual switch
• Guest VM - a host-based firewall, antivirus or application whitelisting per VM according to the OT vendor’s approved list, plus regular patches
• Recovery - snapshots are not backups: they live on the same storage and are among the first things ransomware deletes. Combine them with offline or immutable backups to ensure recovery
• Visibility - collect and monitor audit and logging data from the hypervisor and the management console centrally

Standards align with this. IEC 62443-3-3 requires, among other things, network segmentation (SR 5.1), control system backup (SR 7.3) and control system recovery and reconstitution (SR 7.4), also when that system runs virtualised. NIST described the specific risks of full virtualisation as early as January 2011 in SP 800-125, and the architecture measures in NIST SP 800-82, such as segmentation and defence in depth, apply fully to a virtualised OT environment. Together they show that virtual security is part of OT security, not a separate IT topic.

🇳🇱 What does this mean for Dutch and EU organisations?

For organisations under the Dutch Cyberbeveiligingswet, the national implementation of NIS2 in force since 15 August 2026, hypervisors and management consoles fall squarely within the duty of care: patch management, access control, backups and business continuity apply to the virtual layer just as much as to the VMs themselves. A ransomware attack on an ESXi cluster takes down the entire supervisory layer at once and may then be a reportable incident.

Licensing is a second factor. Broadcom completed its acquisition of VMware on 22 November 2023, ended perpetual licences and moved to subscriptions. The free edition of ESXi also disappeared in early 2024; since April 2025 (ESXi 8.0 Update 3e) a free version is available again, but without vCenter management, HA or support and with a limit of 8 vCPUs per VM, so it is not suitable for production OT. As a result, many industrial companies are reconsidering their platform, for example in favour of Hyper-V or Proxmox VE. Such a migration should always go through change management and be approved by the OT vendors.

❓ Frequently asked questions

Is a VM suitable for real-time control?

A VM on a standard hypervisor is usually not suitable for hard real-time control with cycle times of a few milliseconds, because vCPU scheduling is not deterministic. For supervision, historians and MES, a VM is common practice. Virtual PLCs therefore often run on dedicated real-time hypervisors or edge platforms rather than on an ordinary server cluster.

Is a snapshot of a VM the same as a backup?

No, a snapshot of a VM depends on the original virtual disk and sits on the same storage. If that storage is lost or ransomware wipes the snapshots, there is nothing to roll back to. A real backup is independent of the host, preferably offline or immutable.

Which hypervisor is most widely used in OT?

In OT, VMware ESXi has historically been the most widely supported hypervisor for SCADA and DCS software, with Microsoft Hyper-V as an important alternative. Since Broadcom’s licensing changes, more organisations are also looking at KVM-based platforms such as Proxmox VE. What ultimately decides is which hypervisor your OT vendor officially supports.

Does every VM need its own antivirus and patches?

Yes, every VM is a complete computer with its own operating system and therefore needs its own patches and endpoint protection. In OT this is done with products and versions approved by the application vendor. The hypervisor itself must also be patched, because a vulnerability there affects all VMs at once.

Can an attacker take over the host from inside a VM?

This is called a VM escape; it is rare, but it does happen: in March 2025 three actively exploited ESXi vulnerabilities that made it possible were patched. Patching the hypervisor quickly and limiting administrator rights inside VMs greatly reduce this risk. For the same reason, do not casually place VMs with different trust levels on the same host.

What happens to a VM when the physical host fails?

With high availability, a VM automatically restarts on another host in the cluster after a host failure, with an interruption of a few minutes: the time to detect the failure plus the boot time. With fault tolerance, a shadow copy runs continuously alongside it and the interruption is close to zero. Without a cluster, the VM stays down until the host is repaired or the VM is restored from a backup.

📌 In summary

A VM turns a physical server into a flexible platform on which several OT systems run safely side by side, recover faster and can be supported for longer. The gains only come with good design: redundant hosts, reserved resources, separated networks, real backups and a tightly secured hypervisor.

A Virtual Machine is a flexible and efficient way to host industrial software in OT environments, provided the hypervisor is managed and secured as carefully as the systems running on it.