Our security provider(s) return instances of various factories, these are largely stateless so the instances created should be cached so they can be returned again for future calls.