A controller device is connected to a group of virtual machines and one or more network devices in a network. The controller device is configured to store policies relating to when to start up and when to shut down the virtual machines based on users logging into the network, users logging out of the network, users attempting to access the plurality of virtual machines, and/or particular types of traffic in the network; receive network activity data from a network device of the one or more network devices in the network; identify, based on the network activity data and the policies, a virtual machine, of the group of virtual machines, to start up or shut down; and cause the virtual machine to start up or shut down.