The API spec for java.security.Security does not clearly define what the notion of "installed" provider is. I suspect the wording dates back to JDK 8 and the extension mechanism. Since JDK 9, I think it means that the security provider is listed in a security.provider.$N property in $JDK/conf/java.security. The API docs need to be re-examined, maybe to replace the notion of installed providers with something that clearly defines what security providers are located by the class.