I feel like in some cases we should be using virtual machines. Especially in domains where risk is non-trivial. How do you change developer and user habits tho

I feel like in some cases we should be using virtual machines. Especially in domains where risk is non-trivial. How do you change developer and user habits though? It's not as easy as people think.