A method comprising: receiving, at data processing hardware, an indication of compromise, the indication of compromise indicating an attack is imminent against a virtual machine; in response to receiving the indication of compromise and before the attack against the virtual machine begins: snapshotting, by the data processing hardware, a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine; and increasing, by the data processing hardware, a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing, the heightened level of auditing generating data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine; and after the attack against the virtual machine has begun: maintaining, by the data processing hardware, the heightened level of auditing for a threshold period of time; notifying, by the data processing hardware, a user of the virtual machine of the indication of compromise; and storing, by the data processing hardware, the data in memory external to the virtual machine. receiving, at data processing hardware, an indication of compromise, the indication of compromise indicating an attack is imminent against a virtual machine; in response to receiving the indication of compromise and before the attack against the virtual machine begins: snapshotting, by the data processing hardware, a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine; and increasing, by the data processing hardware, a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing, the heightened level of auditing generating data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine; and snapshotting, by the data processing hardware, a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine; and increasing, by the data processing hardware, a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing, the heightened level of auditing generating data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine; and after the attack against the virtual machine has begun: maintaining, by the data processing hardware, the heightened level of auditing for a threshold period of time; notifying, by the data processing hardware, a user of the virtual machine of the indication of compromise; and storing, by the data processing hardware, the data in memory external to the virtual machine. maintaining, by the data processing hardware, the heightened level of auditing for a threshold period of time; notifying, by the data processing hardware, a user of the virtual machine of the indication of compromise; and storing, by the data processing hardware, the data in memory external to the virtual machine.