A method of securing a dynamic virtualized network, the method comprising: learning, by a network automation device associated with the dynamic virtualized network, a current network policy of the dynamic virtualized network by snooping multicast join messages and multicast leave messages communicated to the dynamic virtualized network, wherein the dynamic virtualized network is a virtualized layer 2 network that is overlaid on a layer 3 network, the layer 3 network includes a plurality of network access devices; the current network policy includes a first plurality of network policy elements, each of the first plurality of network policy elements identifies an authorized endpoint and which port of which network access devices has an authorized endpoint in the dynamic virtualized network; identifying the network access devices of the plurality of network access devices that are affected by the current network policy; determining a network security policy for each of the affected network access devices, wherein the network security policy includes one or more second network policy elements that is a different network policy element than one of the plurality of first network policy elements of the current network policy, by adding, for each of the one or more second network policy network elements, an additional policy regarding how network traffic in the dynamic virtualized network is processed by a port of one of the affected network access devices; applying the network security policy to the identified network access devices; and continuing to monitor the dynamic virtualized network for changes in membership of the dynamic virtualized network. learning, by a network automation device associated with the dynamic virtualized network, a current network policy of the dynamic virtualized network by snooping multicast join messages and multicast leave messages communicated to the dynamic virtualized network, wherein the dynamic virtualized network is a virtualized layer 2 network that is overlaid on a layer 3 network, the layer 3 network includes a plurality of network access devices; the current network policy includes a first plurality of network policy elements, each of the first plurality of network policy elements identifies an authorized endpoint and which port of which network access devices has an authorized endpoint in the dynamic virtualized network; identifying the network access devices of the plurality of network access devices that are affected by the current network policy; determining a network security policy for each of the affected network access devices, wherein the network security policy includes one or more second network policy elements that is a different network policy element than one of the plurality of first network policy elements of the current network policy, by adding, for each of the one or more second network policy network elements, an additional policy regarding how network traffic in the dynamic virtualized network is processed by a port of one of the affected network access devices; applying the network security policy to the identified network access devices; and continuing to monitor the dynamic virtualized network for changes in membership of the dynamic virtualized network.