A method in a building access control system includes receiving a first access control event from a sensor indicating a door has been forced open or has been held open for at least a predetermined amount of time, identifying a second access control event associated with the door, determining whether to generate an alarm by evaluating the second access control event relative to the first access control event, and providing the alarm to a user of the access control system responsive to a determination that the alarm should be generated.