Is that what the "allow to run" option in security settings is doing in the background?