A method and program product for automatically and securely updating software on a virtual machine (VM). A VM coming online in a virtualized server is detected. A current version of the software that is installed on the VM is determined. The current version is determined to not match an updated version of the software available from a remote update server via a network. The updated version of the software is received from the remote update server and via the network without the VM being connected to the network. A confirmation is received indicating that the updated version of the software is installed on the VM. In response to receiving the confirmation, the VM is connected to the network.