

Or they work in a regulated industry that requires pseudo-airgapped machines for remote users, e.g. the machine actually interacting with the systems needs to be within the controlled boundary but the company has a presence in multiple locations, so the solution is to have a Citrix server that the users remote into. But because the SSP also has access control requirements at every stage that take a long time to get updated to newest industry standards, the user still needs to have passwords rotated, MFA, and all that kaboodle.
The other responses have so far talked about hardware setup, so I’m not going to do that. Instead I’m looking at your software setup: VMs can be comparatively power inefficient compared to containers, specially for always-on services that idle often.