A method comprising: receiving, at data processing hardware , an indication of compromise , the indication of compromise indicating an attack is imminent against a virtual machine ; in response to receiving the indication of compromise and before the attack against the virtual machine begins: snapshotting, by the data processing hardware , a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine ; and increasing, by the data processing hardware , a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing , the heightened level of auditing generating data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine ; and after the attack against the virtual machine has begun: maintaining, by the data processing hardware , the heightened level of auditing for a threshold period of time; notifying, by the data processing hardware , a user of the virtual machine of the indication of compromise ; and storing, by the data processing hardware , the data in memory external to the virtual machine . receiving, at data processing hardware , an indication of compromise , the indication of compromise indicating an attack is imminent against a virtual machine ; in response to receiving the indication of compromise and before the attack against the virtual machine begins: snapshotting, by the data processing hardware , a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine ; and increasing, by the data processing hardware , a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing , the heightened level of auditing generating data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine ; and snapshotting, by the data processing hardware , a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine ; and increasing, by the data processing hardware , a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing , the heightened level of auditing generating data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine ; and after the attack against the virtual machine has begun: maintaining, by the data processing hardware , the heightened level of auditing for a threshold period of time; notifying, by the data processing hardware , a user of the virtual machine of the indication of compromise ; and storing, by the data processing hardware , the data in memory external to the virtual machine . maintaining, by the data processing hardware , the heightened level of auditing for a threshold period of time; notifying, by the data processing hardware , a user of the virtual machine of the indication of compromise ; and storing, by the data processing hardware , the data in memory external to the virtual machine . <EOS>