A method for enhancing automated transaction machine (ATM) security surveillance. The method consists of receiving a set of data from a financial device and generating a template for the financial device. The method generates an analysis by analyzing a portion of the received set of data. The method then determines a likelihood factor that the analyzed first portion is associated with a security threat, wherein if the likelihood factor is above a threshold then the method generates a second analysis by analyzing a second portion of the received first set of data and revises the likelihood factor based on the second analysis. The method generates a notice if the first likelihood factor exceeds a second threshold and then updates the template with the analysis and the likelihood factor and receives a second set of data from the monitoring device. The method updates the template with the second set of data.