public SecurityManager getSecurityManager() throws IllegalStateException {
        SecurityManager securityManager = lookupSecurityManager();
        if (securityManager == null) {
            throw new IllegalStateException("No SecurityManager found in Environment.  This is an invalid "
                    + "environment state.");
        }
        return securityManager;
    }
Returns the application's {@code SecurityManager} instance accessible in the backing map using the
{@link #getSecurityManagerName() securityManagerName} property as the lookup key.
<p/>
This implementation guarantees that a non-null instance is always returned, as this is expected for
Environment API end-users.  If subclasses have the need to perform the map lookup without this guarantee
(for example, during initialization when the instance may not have been added to the map yet), the
{@link #lookupSecurityManager()} method is provided as an alternative.

@return the application's {@code SecurityManager} instance accessible in the backing map using the
{@link #getSecurityManagerName() securityManagerName} property as the lookup key.
core/src/main/java/org/apache/shiro/env/DefaultEnvironment.java