They could have been checking the processes that initialise the VMs to ensure they've got secure defaults though