I think he's saying that unpatched, a co-resident VM can compromise the host even if you are locally patched. If the host is patched this doesn't matter (for V

I think he's saying that unpatched, a co-resident VM can compromise the host even if you are locally patched. If the host is patched this doesn't matter (for VM escapes); however, for those on public clouds that will apply the host patching globally, you will be eating the performance degradation whether or not your workload cares about it. I don't think AWS et al will be offering a "run unpatched instance" option. Or maybe they will, this looks pretty devastating for some workloads; on the other hand, cloud providers could actually end up making a lot of money from this issue...