A network functions virtualization, NFV, network system for securely bootstrapping a virtual network function, VNF, the NFV network system comprising: a hardware processor; a VNF bootstrap service, VBS ; a VBS agent associated with a VNF instance ; and wherein a hypervisor is to: (i) receive a command to spin-up the VNF instance based on a signed VNF image and a signed VNF descriptor, the command including a set of VBS startup parameters, (ii) verify an authenticity of the received command, (iii) instantiate the VNF instance based on the set of VBS startup parameters, and (iv) register the instantiated VNF instance with a Trusted Execution Environment, TEE , and wherein the VBS agent is initiated responsive to instantiation of the VNF instance , the VBS agent to: (i) generate a public/private key pair for the VNF instance , (ii) request a security quote from the TEE using the public key of the public/private key pair for the VNF instance , wherein the request is used to calculate a quote hash and sign the quote hash using a private key of the TEE , (iii) execute , after having received the signed quote hash from the TEE , a VBS capture protocol with the VBS to enable secure communication of the VBS agent with the VBS, wherein the VBS capture protocol is to verify the signed quote hash, (iv) activate the VNF instance , and (v) transmit an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated. a hardware processor; a VNF bootstrap service, VBS ; a VBS agent associated with a VNF instance ; and wherein a hypervisor is to: (i) receive a command to spin-up the VNF instance based on a signed VNF image and a signed VNF descriptor, the command including a set of VBS startup parameters, (ii) verify an authenticity of the received command, (iii) instantiate the VNF instance based on the set of VBS startup parameters, and (iv) register the instantiated VNF instance with a Trusted Execution Environment, TEE , and (i) receive a command to spin-up the VNF instance based on a signed VNF image and a signed VNF descriptor, the command including a set of VBS startup parameters, (ii) verify an authenticity of the received command, (iii) instantiate the VNF instance based on the set of VBS startup parameters, and (iv) register the instantiated VNF instance with a Trusted Execution Environment, TEE , and wherein the VBS agent is initiated responsive to instantiation of the VNF instance , the VBS agent to: (i) generate a public/private key pair for the VNF instance , (ii) request a security quote from the TEE using the public key of the public/private key pair for the VNF instance , wherein the request is used to calculate a quote hash and sign the quote hash using a private key of the TEE , (iii) execute , after having received the signed quote hash from the TEE , a VBS capture protocol with the VBS to enable secure communication of the VBS agent with the VBS, wherein the VBS capture protocol is to verify the signed quote hash, (iv) activate the VNF instance , and (v) transmit an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated. (i) generate a public/private key pair for the VNF instance , (ii) request a security quote from the TEE using the public key of the public/private key pair for the VNF instance , wherein the request is used to calculate a quote hash and sign the quote hash using a private key of the TEE , (iii) execute , after having received the signed quote hash from the TEE , a VBS capture protocol with the VBS to enable secure communication of the VBS agent with the VBS, wherein the VBS capture protocol is to verify the signed quote hash, (iv) activate the VNF instance , and (v) transmit an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated. <EOS>