Techniques such as extracting operating parameters, comparing application profiles across VMs (to look for signs that one has been successfully attacked), and analyzing application behavior in memory (as opposed to just code stored on disk) are far easier in a virtualenvironment and provide a huge advantage for stopping the most sophisticated threats.