Virtual desktop infrastructure, or VDI, runs each user's desktop as a virtual machine on servers in a data center or cloud, and the user sees it through a remote display. It moves data and control off the laptop. It also puts many desktops on shared hosts, which NIST says can raise the impact of a single compromise.
How does VDI differ from a normal laptop?
On a normal laptop, the operating system, files and applications live on the device. With VDI, the endpoint becomes a thin window. Keystrokes and screen images travel over the network, while applications and data stay on the host. Teams choose it to keep source code or regulated data out of unmanaged devices, to onboard contractors quickly, or to reset a damaged desktop to a clean image.
That description is the common industry meaning, not a quote from a standard, so check how a given product defines it.
What does NIST say about virtualization risk?
NIST SP 800-125, the Guide to Security for Full Virtualization Technologies, covers server and desktop virtualization. Its cautions apply directly:
- Virtualization adds layers of technology, which can increase the security management burden by needing additional controls.
- Combining many systems onto a single physical computer can cause a larger impact if a compromise occurs.
- Some virtualization systems make it easy to share information between systems, and that convenience can become an attack vector if not carefully controlled.
- Virtual environments can be dynamic, which makes creating and maintaining security boundaries more complex.
The same document recommends securing the hypervisor like any software, installing updates as they arrive, and also disabling unused virtual hardware and unneeded hypervisor services such as clipboard or file sharing.
NIST also notes a benefit: desktop virtualization allows changes to be reverted to the original, for instance to eliminate changes that harm security, and supports better control over whether operating systems meet requirements.
What does this look like in practice?
Constructed example. A design agency moves contractors onto VDI so that client files never reach personal laptops. Good. Then a contractor's browser extension, running on the personal laptop, reads the screen and clipboard. The files never left the data center, but the content did.
The lesson is that VDI controls where the data sits, not who can see the rendered screen. Disable clipboard redirection, file transfer, printing and drive mapping unless a use case needs them, which matches the NIST advice on sharing features.
How does VDI fit with zero trust?
NIST SP 800-207 describes a resource portal deployment model, where a gateway acts as the single access point to a resource or a protected group of resources. Its main benefit is that no software component has to be installed on every client device, and it suits BYOD and cross-organization work. A VDI gateway behaves much like this, and the rest of the zero trust tenets still apply: verify identity and device posture for each session, not once per day.
How to check or apply this
- Decide what VDI is for: contractors, regulated data, shared workstations. Your answer sets the controls.
- Turn off clipboard, file transfer, drive mapping and printing by default. Enable per group with a written reason.
- Patch the hypervisor and the management plane on a fixed schedule, and limit who can administer them.
- Build desktops from a clean, versioned image and reset them often.
- Require strong, phishing-resistant sign-in at the gateway, and check device posture.
- Log sessions: who connected, from where, and what was transferred.
- Separate pools by sensitivity so a breach of a low-risk pool does not reach a high-risk one.
Quick check
Does VDI stop malware?
No. It changes where malware runs. A compromised virtual desktop can still reach whatever the desktop can reach, so segment the network behind it and keep images clean.
Is the hypervisor a single point of failure for security?
It is a high-value target, because many desktops depend on it. NIST recommends patching it, disabling unneeded services and monitoring it for signs of compromise.
Sources
- NIST SP 800-125, Guide to Security for Full Virtualization Technologies
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
