arf indeed, we need at least one where the security is not disabled.