The idea is that the WidlflySecurityManager may be turned on or off in runtime, and WidlflySecurityManager.isChecking() provides such detail. The WidlflySecurityManager will also be responsible for not doing privileged actions unless it is needed. There is no overhead without a security manager other than one more handler in the stack trace.