1. A computer-implemented method for collecting usage data, comprising: loading, by a hypervisor of a host machine, a virtual trusted platform module (vTPM) into a virtual hardware layer of a virtual machine on the host machine; loading a virtual firmware into the virtual hardware layer of the virtual machine, wherein the virtual firmware is operative in the virtual hardware layer at a higher level of trust than a kernel of the virtual machine, and wherein the loading the virtual firmware is monitored by the vTPM to ensure secure communication between the virtual firmware and the kernel of the virtual machine; running the virtual firmware in the virtual hardware layer and in the kernel of the virtual machine, the virtual firmware being protected from a user space of the virtual machine, wherein the virtual firmware is executed as an agent within the kernel, and wherein the agent collects usage data from a kernel subsystem within the kernel of the virtual machine; receiving, at the virtual firmware via the agent within the kernel, the usage data of the virtual machine, the usage data describing resource utilization of the virtual machine and being protected from the user space of the virtual machine; transmitting the usage data from the virtual firmware to a collector on the host machine, wherein the collector collects the usage data; and modifying one or more services to the virtual machine based on the usage data collected by the collector.