A computer-implemented method for execution in a virtual security system, the method comprising: detecting (1404, 1502) a change for a guest virtual machine in a virtual server of a virtual network infrastructure, wherein a security policy is associated with the guest virtual machine, the security policy specifying a plurality of virtual security appliances, VSAs, each of the plurality of VSAs implementing a different type of security inspection to network packets of the guest virtual machine; determining (1406, 1508) whether the plurality of VSAs associated with the guest virtual machine through the security policy are configured as virtual machines in the virtual server; if it is determined that the plurality of VSAs associated with the guest virtual machine through the security policy are not configured as virtual machines in the virtual server, blocking (1412, 1510) the guest virtual machine from running in the virtual server and sending (1414, 1512) a request to create the plurality of VSAs associated with the guest virtual machine through the security policy as virutal machines in the virtual server; and allowing (1430, 1518) the guest virtual machine to initiate when the plurality of VSAs associated with the guest virtual machine through the security policy are created in the virtual server; intercepting network packets associated with the guest virtual machine to route the network packets to the plurality of VSAs, wherein the plurality of VSAs perform respective security inspections on the network packets sent from the guest virtual machine, determining a utilization rate of one or more VSAs of the plurality of VSAs on the virtual server; and based on the utilization rate of the one or more VSAs, increasing or decreasing computing resources assigned to the one or more VSAs and/or adding one or more additional VSAs to the virtual server. detecting (1404, 1502) a change for a guest virtual machine in a virtual server of a virtual network infrastructure, wherein a security policy is associated with the guest virtual machine, the security policy specifying a plurality of virtual security appliances, VSAs, each of the plurality of VSAs implementing a different type of security inspection to network packets of the guest virtual machine; determining (1406, 1508) whether the plurality of VSAs associated with the guest virtual machine through the security policy are configured as virtual machines in the virtual server; if it is determined that the plurality of VSAs associated with the guest virtual machine through the security policy are not configured as virtual machines in the virtual server, blocking (1412, 1510) the guest virtual machine from running in the virtual server and sending (1414, 1512) a request to create the plurality of VSAs associated with the guest virtual machine through the security policy as virutal machines in the virtual server; and allowing (1430, 1518) the guest virtual machine to initiate when the plurality of VSAs associated with the guest virtual machine through the security policy are created in the virtual server; intercepting network packets associated with the guest virtual machine to route the network packets to the plurality of VSAs, wherein the plurality of VSAs perform respective security inspections on the network packets sent from the guest virtual machine, determining a utilization rate of one or more VSAs of the plurality of VSAs on the virtual server; and based on the utilization rate of the one or more VSAs, increasing or decreasing computing resources assigned to the one or more VSAs and/or adding one or more additional VSAs to the virtual server.