I received a notification on Big Sur that an extension was updated and this must be authorised in System Preferences. It is 'System software from developer "Apple Inc."'. I find this odd:
I didn't receive any such notification in the past about Apple's own software (although I have occasionally received similar notifications about third party software). I would expect kernel extension updates to only occur via official software updates, which presumably do not require such warnings (or, if anything has changed there, then Software Update process is at least clearly happening rather than silently taking places in the background).
I had not performed an update of any kind immediately preceding this (that I know of).
FortiClient had just run. I believe it does some self-updating. I have a dim view of the software; it is always trying to be invasive and is regularly refused rights for various unnecessary installations of its own.
I see the situation as potentially risky: it is possible that either someone is pretending to be Apple who isn't, or that someone is trying to modify an Apple extension.
How can I find out which extension is being updated and which process initiated this? I did not have much luck looking in Console logs or
kext command-line utilities. None of the files in
/System/Library/Extensions appear to have been modified recently.