Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus).
How vulnerable is in this context a VM with a not up to date windows OS and an old and not up to date antivirus? 1)
What factors (if any) affects this? Internet access, VM guest settings, etc.
1) Let's say you have a an old VM you need to work on, for which an update would have a significant cost, or not be possible (legacy applications support, or simply the VM scope is to test an application in that specific environment).
Apparently my question is not clear enough. So let me rephrase it like this: You have a system A that is safe from wannacry (i.e. it is patched and it cannot get infected, has up to date antivirus). You have a system B, which, on it's own is not safe from wannacry (i.e. not patched, it can get infected, old antivirus definitions). If you run system B as a VM inside system A, can B still get infected, or does the fact that it runs as a VM inside a secure system blocks the attack vector? Can the A's antivirus prevent wannacry from entering B?