You can enable the Shielded VM service on your Compute Engine VM
instances to help defend against rootkits and bootkits. Shielded VM
leverages advanced platform security capabilities such as
[Secure Boot](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#secure-boot),
[Virtual trusted platform module (vTPM)](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm)-enabled
[Measured Boot](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#measured-boot), and
[Integrity monitoring](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#integrity-monitoring).

> [!NOTE]
> **Note:** To help prevent security issues, you must ensure your instances have the latest available Microsoft Secure Boot certificates. For detailed instructions on identifying and updating affected VMs, see the [Microsoft Secure Boot certificates expiration guide](https://docs.cloud.google.com/compute/docs/security/ms-secure-boot-certificates-expiration).

For a more detailed overview, see
[Key concepts for Shielded VM](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm).

To get started using Shielded VM, try the
[quickstart](https://docs.cloud.google.com/compute/shielded-vm/docs/quickstart)
or see
[Modifying Shielded VM options](https://docs.cloud.google.com/compute/shielded-vm/docs/modifying-shielded-vm).

You can monitor the integrity of your Shielded VMs in some of the
following ways:

- You can use [Cloud Monitoring](https://docs.cloud.google.com/monitoring/docs) to
  [monitor the boot integrity](https://docs.cloud.google.com/compute/shielded-vm/docs/integrity-monitoring) of
  Shielded VM instances. Next, you can identify the cause of an integrity
  validation failure, and update the integrity policy baseline accordingly.

- You can also
  [use a Cloud Run functions trigger to automatically act](https://docs.cloud.google.com/compute/shielded-vm/docs/automating-responses-integrity-failures)
  on integrity monitoring events.