A snapshot may be used to capture and store the condition of a virtual machine. If a snapshot of this kind is restored at a later point in time, all the changes made since it was taken will be lost. As a consequence, any patched vulnerabilities may be reopened. Furthermore, open files, file transfers, or database transactions captured at the time of the snapshot may result in inconsistent data.

Attackers might also misuse snapshots to access the data of a virtual IT system in an unauthorised manner. For example, if a snapshot was made during live operations, the content of the main memory was also saved to the hard disk and may be restored and analysed in a virtual environment outside of the original IT infrastructure. Snapshots can also be large enough to cause a shortage of available storage space.