A read-only mount attaches storage so its contents can be accessed without allowing changes to the stored data. For example, an administrator or forensic analyst may mount a virtual machine disk this way to inspect or copy files while reducing the risk of altering evidence or damaging the original.
In cyber security, read-only access can support safer investigation and data collection. An attacker with access to a hosting control plane may also mount a customer’s virtual disk read-only and copy passwords, API tokens, or other secrets without disrupting the running virtual machine. Because this activity may leave services operating normally, defenders should monitor management-plane access and disk-mount operations, not just changes inside the guest system.