> Has anyone seen anything like this before? 
yes that's why it's in the faq. You haven't shown the part of your
output that is causing the xmlns="".  You have generated an element in
no-namespace with local name security.

You have (presumably) generated a parent element in some other
namespace so xslt has to add the xmlns="".

<security name="ibm" />

is security in no-namespace

but
<foo xmlns="zzz">
<security name="ibm" />
</foo>
would be security in namespace zzz  so in order to output secutity in
no-namespace the system has to output

<foo xmlns="zzz">
<security xmlns="" name="ibm" />
</foo>

to preserve the (no-)namespace of security.

De[ending on hat you want, you should either generate the parent element
in no-namespace to make

<foo>
<security name="ibm" />
</foo>

or generate security in a namespace, to make

<foo xmlns="zzz">
<security name="ibm" />
</foo>

David