"I think the icon image is just fine. What I would like to suggest is that the icon reflect the status of SAS. For instance the icon could indicate update availability, real time protection ON/OFF, scan in progress, things along those lines. At a minimum perhaps the icon could turn red when SAS wants to alert the user about something, such as outdated signatures? A number of other security programs do this and I've noticed it helps me catch problems."
For instance the icon could indicate real time protection ON/OFF