Endpoint Security Framework deadline

Hello.

When testing with the Endpoint Security Framework for the AUTH_OPEN event, I found that the deadline was 15 seconds, but the actual process termination occurred at 5 or 6 seconds. Is this intended?

Endpoint Security Framework deadline
 
 
Q