protected SecurityManager lookupSecurityManager() {
        String name = getSecurityManagerName();
        return getObject(name, SecurityManager.class);
    }
Looks up the {@code SecurityManager} instance in the backing map without performing any non-null guarantees.

@return the {@code SecurityManager} in the backing map, or {@code null} if it has not yet been populated.
core/src/main/java/org/apache/shiro/env/DefaultEnvironment.java