A computer-implemented method for automatically provisioning system virtual computing machines, comprising: detecting start up of a system virtual machine; assigning a community-of-interest to the virtual machine when the start up of the virtual machine is detected, the community-of-interest consisting of a set of virtual machines all owned by the same tenant and shielded behind a virtual gateway in an enclave, transmissions between the virtual machines in the community-of-interest being encrypted with keys that are not available to virtual machines outside the community-of-interest, wherein the virtual gateway acts as a gateway to unencrypted networks; and configuring the virtual machine for communications with the virtual gateway in the community-of-interest; wherein the virtual machine may only communicate securely with other members of the community-of-interest, wherein dynamic licensing is implemented within the enclave to allow the virtual machines within the enclave to obtain dynamic licences through the virtual gateway, the dynamic licences being for software running in the virtual machines, and wherein: i) the step of assigning the community-of-interest to the virtual machine comprises transmitting a certificate to the virtual machine, in which the certificate includes a community-of-interest key corresponding to the assigned community-of-interest wrapped in the certificate; ii) optionally in which the step of transmitting a certificate to the virtual machine comprises transmitting an encryption key, in which the encryption key is encrypted with the community-of-interest key; and iii) optionally in which the step of transmitting the certificate comprises transmitting the certificate from a jumpbox coupled to the virtual machine. detecting start up of a system virtual machine; assigning a community-of-interest to the virtual machine when the start up of the virtual machine is detected, the community-of-interest consisting of a set of virtual machines all owned by the same tenant and shielded behind a virtual gateway in an enclave, transmissions between the virtual machines in the community-of-interest being encrypted with keys that are not available to virtual machines outside the community-of-interest, wherein the virtual gateway acts as a gateway to unencrypted networks; and configuring the virtual machine for communications with the virtual gateway in the community-of-interest; wherein the virtual machine may only communicate securely with other members of the community-of-interest, wherein dynamic licensing is implemented within the enclave to allow the virtual machines within the enclave to obtain dynamic licences through the virtual gateway, the dynamic licences being for software running in the virtual machines, and wherein: i) the step of assigning the community-of-interest to the virtual machine comprises transmitting a certificate to the virtual machine, in which the certificate includes a community-of-interest key corresponding to the assigned community-of-interest wrapped in the certificate; ii) optionally in which the step of transmitting a certificate to the virtual machine comprises transmitting an encryption key, in which the encryption key is encrypted with the community-of-interest key; and iii) optionally in which the step of transmitting the certificate comprises transmitting the certificate from a jumpbox coupled to the virtual machine. i) the step of assigning the community-of-interest to the virtual machine comprises transmitting a certificate to the virtual machine, in which the certificate includes a community-of-interest key corresponding to the assigned community-of-interest wrapped in the certificate; ii) optionally in which the step of transmitting a certificate to the virtual machine comprises transmitting an encryption key, in which the encryption key is encrypted with the community-of-interest key; and iii) optionally in which the step of transmitting the certificate comprises transmitting the certificate from a jumpbox coupled to the virtual machine.