The Security Manager is installed in the base VTS code as a start-able service; that is, it resides in the SERVICES class section of the VTS AppMod.src file. It is therefore always active, and is always monitoring user activity.