1. A method for use in a computing system, the computing system comprising a host computing device coupled to a network, a library which does not have access to the network, and a maintenance host computing device which does not have access to the network, wherein the network may pose a security risk to the host computing device and any virtual machine (VM) deployed on the host computing device, the method comprising: storing a VM in a halted form in the library; retrieving the VM from the library; re-starting the VM on the maintenance host computing device; updating each non-current software construct of the re-started VM at the maintenance host computing device by obtaining the required software update from a corresponding update source as at least one patch; halting the updated VM and storing the halted updated VM at the library; to await retrieval and re-starting the updated VM at the host computing device.