The data model should likely include information about the VMs themselves, similar to platform nodes. There should be a separate table (or tables) to represent components, i.e. packages installed in the VM. And there should be a table (or tables) to represent vulnerabilities identified on the host.

This assumes that we can't reuse existing tables for this data.