A virtual network function, VNF, bootstrap service, VBS, agent (448, 450, 452) of a VNF instance configured to perform a secure bootstrap process by executing a secure VNF bootstrap capture protocol to securely register the VNF instance as an operational VNF instance in a network functions virtualization NFV network architecture, the VBS agent (448, 450, 452) comprising: a VBS capture protocol execution module to execute the secure VNF bootstrap capture protocol including to securely transmit a start message to a VBS of the NFV network architecture, wherein the VBS is communicatively coupled to the VBS agent (448, 450, 452), and wherein the start message provides an indication that the VBS agent (448, 450, 452) is instantiated, securely receive a start response message from the VBS in response to transmission of the start message, securely transmit a registration request message to the VBS in response to receiving the start response message, wherein the registration request message includes a security quote usable to authenticate the VBS agent (448, 450, 452) as the transmitter of the registration request message and a security credential request to request a security credential from the VBS, securely receive a registration response message from the VBS, wherein the registration response message includes a security credential that indicates that the security quote and the security credential request have been validated by the VBS, activate the VNF instance to actively process network traffic received by the VNF instance in response to having received the security credential; and transmit an indication to a VNF manager of the NFV network architecture that indicates to the VNF manager that (i) the VNF instance is active and (ii) the configuration of the VNF instance is to be managed by the VNF manager, wherein the indication includes a VNF instance identifier that is unique to the VNF instance and usable to add the VNF instance to a whitelist of authorized VNF instances at the VNF manager. securely transmit a start message to a VBS of the NFV network architecture, wherein the VBS is communicatively coupled to the VBS agent (448, 450, 452), and wherein the start message provides an indication that the VBS agent (448, 450, 452) is instantiated, securely receive a start response message from the VBS in response to transmission of the start message, securely transmit a registration request message to the VBS in response to receiving the start response message, wherein the registration request message includes a security quote usable to authenticate the VBS agent (448, 450, 452) as the transmitter of the registration request message and a security credential request to request a security credential from the VBS, securely receive a registration response message from the VBS, wherein the registration response message includes a security credential that indicates that the security quote and the security credential request have been validated by the VBS, activate the VNF instance to actively process network traffic received by the VNF instance in response to having received the security credential; and transmit an indication to a VNF manager of the NFV network architecture that indicates to the VNF manager that (i) the VNF instance is active and (ii) the configuration of the VNF instance is to be managed by the VNF manager, wherein the indication includes a VNF instance identifier that is unique to the VNF instance and usable to add the VNF instance to a whitelist of authorized VNF instances at the VNF manager.