Does this pose a security risk?
Many times the CIS icon tray is only loaded long after my internet connection is established like 10 seconds or so.
There is no security risk. The icon in the systray is for cfp.exe.
Cfp.exe is the client; it is the user interface the users know and use to instruct the “under water” process cmdagent.exe. Under cmdagent functions the driver inspect.sys. Cmdagent and the driver are already active before Windows reaches the desktop.