I'm surprised I had to scroll this far into the comments to find this obvious answer. Each of my customers has a dedicated VM and I compartmentalize all sensit

I'm surprised I had to scroll this far into the comments to find this obvious answer. Each of my customers has a dedicated VM and I compartmentalize all sensitive data into each environment. In this manner, I can run each customer's goofy VPN client, endpoint scanning, device policy compliance etc without any of it touching my primary system. If there is some security exposure in one of the VMs, it won't impact my primary system or adjacent systems (short of a VM escape exploit).