I have a virtual machine with Windows 10 as its guest and Ubuntu 14.04 as its host. My router has its SPI firewall enabled, with only ports 22 and 80 being forwarded to the Ubuntu host. The Windows guest has a manual IP set outside the DHCP range of the router, and its gateway setting is left blank. That allows its files to be accessed via SMB on the local network, but it has no route to the Internet. I don't have any anti-virus software on the VM, and it doesn't receive any software updates. Its only purpose is to serve files in conjunction with software that only runs on Windows. I figured that it's secure because it doesn't have direct access to the outside world.
Should I consider the VM to be safe and secure? Should I take any steps to make it more secure?
Edit: I should also note that the guest has a bridged network adapter, meaning it has a real IP address on the LAN, like every other physical machine.