Of course, if you follow strong VM security practices you can minimize the risk. Good VM security practices include:

• Treat and secure your VM sessions as thoroughly as you do each physical machine under your control, or even consider stronger controls
• Make sure to keep your VM software patched
• Minimize the guest-to-host connections and tools (if it ain't needed, don't install)
• Make sure low value, high-risk guest sessions are not running on the same host as high-value guest sessions ( e.g. don't run a public Web server on the same host as your internal PKI server)
• Take VM vendors security attestations with a grain of salt

I remember sitting in Blackhat last year and hearing from a senior VM developer about the inherent risks involved in using a hypervisor, all of which are challenging for any VM vendor to solve. This is a great discussion on the benefits of a hypervisor layer, along with the inherent risks and challenges. Pay special attention to slides 13-19. Slide 15 is what led me to questioning "we improve security" VM vendors more. The same presenter has added on to his comments. He is painting both sides of the story and treating us like adults.

I think the developers at any VM vendor know the security risks they are coding against, but those risks aren't shared with marketing. Hold your VM vendor accountable to speak about security risks in a reasonable manner. One vendor was publicly embarrassed a few weeks ago for making unrealistic security claims.

Now, there is a possibility that VMs can improve your overall security. First, if a VM is significantly more secure than your physical box, then there is a chance that your overall session security might be improved. Although if your host is insecure, it's a hard argument to sell that something running on it can stay more secure.

Second, VMs allow you to minimize the number of physical boxes to manage. If minimizing the number of computers to secure is easier and more thoroughly done by your limited staff than it would be with more physical computers, perhaps your security risk will actually decrease. But to be honest, I've yet to see that scenario in real life. Most of the customers I've seen actually end up with lax practices and worse security.