public static SecurityManager getSecurityManager(Properties properties) {
    String securityManagerConfig = properties.getProperty(SECURITY_MANAGER);
    if (StringUtils.isBlank(securityManagerConfig)) {
      return null;
    }
    SecurityManager securityManager =
        getObjectOfTypeFromClassName(securityManagerConfig, SecurityManager.class);
    securityManager.init(properties);
    return securityManager;
  }
this method would never return null, it either throws an exception or returns an object
geode-core/src/main/java/org/apache/geode/internal/security/CallbackInstantiator.java