better report when no security object is available (no not create a random one)