System and methods for proactive threat detection in a security system

A security system for a facility, comprising:

• a plurality of sensors each for detecting a corresponding sensed event of the facility;
• a user interface;
• a controller operatively coupled to a plurality of sensors and the user interface, wherein the controller is configured to identify security events of the facility based at least in part on the sensed events detected by the plurality of sensors, the controller is configured to receive user input via the user interface for operating the security system including arming and disarming the security system, the controller configured to:
• store a baseline user input for operating the security system, wherein the baseline user input produces a baseline operation of the security system that can monitor for and identify each of a plurality of baseline security events of the facility;
• raise an alarm when the controller identifies one or more of the plurality of baseline security events of the facility;
• detect an anomaly in the user input relative to the baseline user input;
• determine whether the anomaly in the user input causes the controller to not be able to identify one or more of the plurality of baseline security events of the facility;
• and
• when the anomaly in the user input causes the controller to not be able to identify one or more of the plurality of baseline security events, send a proactive threat detection alert to a remote device.

A method for proactive threat detection in a security system of a facility, wherein the security system includes a controller operatively coupled to a plurality of sensors, wherein each of the plurality of sensors are for detecting a corresponding sensed event of the facility, wherein the controller is configured with a baseline configuration that configures the controller to identify each of a plurality of baseline security events of the facility based at least in part on the sensed events detected by the plurality of sensors, the controller is configured to receive user input for operating the security system including arming and disarming the security system, the method comprising:

• receiving a user input;
• determining whether the user input changes the baseline configuration of the controller such that the controller is no longer able to identify one or more of the plurality of baseline security events;
• and
• when the user input changes the baseline configuration of the controller such that the controller is no longer able to identify one or more of the plurality of baseline security events, providing a proactive threat detection alert.