Cluster security based on virtual machine content

A cluster is scanned. The cluster includes one or more virtual machines. A first content file change is detected based on the scan of the cluster. The first content file change is to a first content file. The first content file is located on a first virtual machine related to the cluster. A content-based security level of the cluster is determined based on the detection of the first content file change. The determined content-based security level of the cluster is compared to a security level standard of the cluster. A security gap is identified based on the comparison of the determined content-based security level to the security level standard of the cluster. In response to the identification of the security gap, an update to the security settings of the cluster is performed.