Sensing performance-centric design plays an important role in the 6G perceptive networks. In this paper, we develop a secure transmission scheme by using dual-functional integrated sensing and communication (ISAC) signals. Specifically, the base station (BS) senses a target of interest while communicating with a legitimate user and preventing information leakage to an eavesdropper simultaneously. The expectational minimum mean square error (EMMSE) is adopted as the sensing metric by considering the randomness of the signal, which is optimized under the constraints of power budget and secrecy rate. Followed by a relaxation process, a two-step rank-constrained algorithm is presented to solve the original non-convex optimization problem. Furthermore, we reveal the subspace tradeoff in the dual-functional ISAC waveform and the power allocation tradeoff in its separated waveforms counterpart, respectively. Simulation results show the effectiveness of the proposed algorithm.