Speed: Absolutely. Out of the box, there are very few PHP frameworks that are faster. Once you apply caching, whether in the framework or through a proxy like Varnish, all apps by any framework can be made to be speedy, but CI works faster natively, and has cache library built in so that you can make it faster where needed. Like anything - how you program can have a large effect on speed, especially when it comes to your database queries, and that's true in any framework.
Security: depends 100% on you and your team. CI's security tools are pretty good, especially when combined with PHP's filter_var, etc. But NONE of that can be automated 100% for you. It is still up to the developer to implement it all correctly. And that's always the tough part. But it's not really a framework-dependent problem. CI's CSRF protection is good, it's XSS filter is pretty good, though will never be perfect (hint: nothing is), and is intended to be used on output, there are tools for preventing SQL injection, etc.
