diff a/src/java.base/share/classes/java/lang/SecurityManager.java b/src/java.base/share/classes/java/lang/SecurityManager.java
--- a/src/java.base/share/classes/java/lang/SecurityManager.java
+++ b/src/java.base/share/classes/java/lang/SecurityManager.java
@@ -311,11 +311,16 @@
  * @see     java.security.Policy Policy
  * @see     java.security.SecurityPermission SecurityPermission
  * @see     java.security.ProtectionDomain
  *
  * @since   1.0
+ * @deprecated The Security Manager is deprecated and subject to removal in a
+ *       future release. There is no replacement for the Security Manager.
+ *       See <a href="https://openjdk.java.net/jeps/411">JEP 411</a> for
+ *       discussion and alternatives.
  */
+@Deprecated(since="17", forRemoval=true)
 public class SecurityManager {
 
     /*
      * Have we been initialized. Effective against finalizer attacks.
      */
@@ -1082,11 +1087,11 @@
      *             {@code null}.
      * @since      1.1
      * @deprecated Use #checkPermission(java.security.Permission) instead
      * @see        #checkPermission(java.security.Permission) checkPermission
      */
-    @Deprecated(since="1.4")
+    @Deprecated(since="1.4", forRemoval=true)
     public void checkMulticast(InetAddress maddr, byte ttl) {
         String host = maddr.getHostAddress();
         if (!host.startsWith("[") && host.indexOf(':') != -1) {
             host = "[" + host + "]";
         }
