I make a unique user for each VM - root account is secured with SSH login disabled and a unique password, which is stored in my password manager.