A method for protecting temporary virtual machine instances from security risks, comprising: monitoring a cloud platform for the assignment of a temporary virtual machine instance to a workload; obtaining information about a configuration of the temporary virtual machine instance and applications deployed on the temporary virtual machine instance; and based on the configuration of the temporary virtual machine instance and applications deployed on the temporary virtual machine instance, generating a security policy to apply to the temporary virtual machine instance; characterized in that: wherein generating a security policy to be applied to the temporary virtual machine instance comprises one of the following: upon determining that the temporary virtual machine instance is allocated to a group of public virtual machine instances, blocking peer virtual machine instances from communicating with the temporary virtual machine instance; or upon determining that the temporary virtual machine instance is allocated to a private group of virtual machine instances, blocking virtual machine instances outside of the private group from communicating with the temporary virtual machine instance; the method further comprising: monitoring network activity on the temporary virtual machine instance; comparing the monitored network activity to network activity from one or more peer virtual machine instances; and detecting, based on the comparison, one or more network traffic anomalies indicative of a security risk to the cloud platform; in particular further comprising one of the following: upon detecting one or more traffic anomalies indicative of a security risk to the cloud platform, quarantining the temporary virtual machine instance; or upon detecting one or more traffic anomalies indicative of a security risk to the cloud platform, terminating the temporary virtual machine instance and spawning a replacement virtual machine instance. monitoring a cloud platform for the assignment of a temporary virtual machine instance to a workload; obtaining information about a configuration of the temporary virtual machine instance and applications deployed on the temporary virtual machine instance; and based on the configuration of the temporary virtual machine instance and applications deployed on the temporary virtual machine instance, generating a security policy to apply to the temporary virtual machine instance; upon determining that the temporary virtual machine instance is allocated to a group of public virtual machine instances, blocking peer virtual machine instances from communicating with the temporary virtual machine instance; or upon determining that the temporary virtual machine instance is allocated to a private group of virtual machine instances, blocking virtual machine instances outside of the private group from communicating with the temporary virtual machine instance; the method further comprising: monitoring network activity on the temporary virtual machine instance; comparing the monitored network activity to network activity from one or more peer virtual machine instances; and detecting, based on the comparison, one or more network traffic anomalies indicative of a security risk to the cloud platform; in particular further comprising one of the following: upon detecting one or more traffic anomalies indicative of a security risk to the cloud platform, quarantining the temporary virtual machine instance; or upon detecting one or more traffic anomalies indicative of a security risk to the cloud platform, terminating the temporary virtual machine instance and spawning a replacement virtual machine instance. monitoring network activity on the temporary virtual machine instance; comparing the monitored network activity to network activity from one or more peer virtual machine instances; and detecting, based on the comparison, one or more network traffic anomalies indicative of a security risk to the cloud platform; in particular further comprising one of the following: upon detecting one or more traffic anomalies indicative of a security risk to the cloud platform, quarantining the temporary virtual machine instance; or upon detecting one or more traffic anomalies indicative of a security risk to the cloud platform, terminating the temporary virtual machine instance and spawning a replacement virtual machine instance.