Past and present experiences point to a seemingly invariant conclusion: virtualization continues to be a promising technology to address information security needs, but it will also continue to fall short of delivering on the ideal of a robust, trustworthy, and mythically flawless computing environment. As the trend toward virtualization accelerates and the technology becomes available to larger user communities at lower costs, the information security community will benefit from the additional hands-on experience to improve security tools and techniques. But malicious attackers certainly won't be spectators in the advancements of those security toolkits. As security practitioners, it's paramount that we adopt a practical and realistic approach to the new wave of virtualization, that we assess the risks with precision, and help align expectations accordingly.