Choose backup retention for virtual machines
Keep enough restore points to recover yesterday’s mistake and last quarter’s compliance question, then delete the rest on purpose.

Daily points for 14 to 30 days cover operator error. Weekly points for a few months cover a quiet corruption. Monthly points for the retention your regulator or contract names cover the long question. Write those three numbers next to the job so a full disk does not invent a new policy overnight.
Immutability or an account that the backup admin cannot delete protects the points from ransomware that also steals backup credentials. Retention without a lock is only a suggestion.
When you shorten retention, restore one old point first so you know which reports you are about to lose.