A snapshot is a point-in-time capture of a virtual machine’s state, including disk and often memory data. It is useful for short-term rollback, testing, and troubleshooting, but it should not be kept indefinitely. Old snapshots can expose sensitive data and make systems harder to manage.
What a snapshot captures
A snapshot is more than a convenience copy. It records a system’s state at a specific moment so operators can roll back after a failed patch, test change, or troubleshooting step. Because it captures disk state and sometimes memory state, it can preserve active data, not just files on disk.
The detail that matters operationally is scope. A snapshot is usually tied to a specific virtual machine, disk, or storage object, and it reflects that object at one point in time. That makes it useful for recovery and analysis, but it also means it is not a substitute for a full backup strategy or for long-term retention.
Why snapshots are useful
Snapshots help teams move quickly when they need a reversible checkpoint. They are commonly used before risky changes, during testing, and when investigating whether a recent change caused instability. In practice, they reduce the cost of experimentation because rollback is faster than rebuilding a system from scratch.
They are also valuable for short-lived troubleshooting, especially when a failure needs to be reproduced or a state needs to be preserved before the system changes again. That convenience is why snapshots are common in virtualised and cloud environments, where fast state capture is often built into the platform.
What snapshots do not protect against
Snapshots preserve state, which is different from resilience. If the underlying workload, configuration, or data is already compromised, a snapshot can faithfully preserve that bad state as well. They also do not provide the same isolation, durability, or retention guarantees as a backup designed for recovery from deletion, corruption, or ransomware.
Snapshots can create false confidence when they are treated as a permanent safety net. They are often closely coupled to the live system, and that coupling can limit portability, recovery options, and governance over how long sensitive data remains available.
Why old snapshots become a management problem
Keeping snapshots for too long adds operational drag. Each additional snapshot can complicate storage management, increase the chance of performance issues, and make it harder to understand which version of a system is current. Over time, the snapshot chain itself can become a dependency that slows administration and recovery.
Long-retained snapshots can also expose sensitive information that would otherwise have been rotated, deleted, or expired. A point-in-time capture may contain credentials in memory, temporary secrets, cached session material, or application data that no longer belongs in active use. That is why snapshot retention should be deliberate rather than accidental.
Risk and Threat Considerations
Snapshots can widen exposure when they outlive their operational purpose. A stale snapshot may preserve sensitive data, old secrets, or a compromised system state, and the longer it exists the more opportunities there are for unauthorised access, misuse, or recovery failure.
Failure mechanism: The snapshot retains disk and sometimes memory content from a time when data, credentials, or configuration may have been less restricted, then remains available after the live system has changed, been remediated, or been rebuilt.
Impact: Attackers or careless operators may recover data that should no longer exist in usable form, while administrators face higher storage, restore, and governance complexity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CP-9 — System Backup | Snapshots are a recovery mechanism that must be governed as part of backup and restoration planning. |
| CM-2 — Baseline Configuration | Snapshots freeze a system state, so configuration baselines matter for deciding what state is safe to preserve. | |
| AU-9 — Protection of Audit Information | Snapshots can preserve logs and system state, so retained images may expose sensitive operational information. | |
| Recommendation — Limit snapshot retention and test restores so recovery checkpoints remain usable when needed. Compare snapshots against approved baselines before using them for rollback or troubleshooting. Protect retained snapshots so sensitive operational data is not exposed through copied state. | ||
| NIST CSF 2.0 | PR.IP-4 — Backups are maintained, protected, and tested | Snapshots are a recovery artifact whose protection and testing affect resilience and restoration outcomes. |
| Recommendation — Treat snapshots as tested recovery artifacts and remove them when they no longer serve recovery needs. | ||
| ISO/IEC 27001:2022 | A.8.13 — Information backup | Snapshots are closely related to backup governance, retention, and recovery planning in Annex A. |
| Recommendation — Set retention and recovery rules for snapshots so they support, rather than replace, backup controls. | ||
Practitioner Guidance
Why practitioners should care: Treat snapshots as a temporary control for rollback and investigation, not as a backup policy or archive. Their value drops quickly once the change window or troubleshooting task is over.
What to watch for: Retention of snapshots after patching, incident response, or major configuration changes is a common sign that operational convenience has overridden data minimisation and lifecycle control.
Practitioner takeaway: Define a clear expiry for each snapshot and review whether its contents could still contain material data, secrets, or a state you would not want to preserve.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org