A controller of a vehicle detects persons that are approaching the vehicle and uses sensors to collect data regarding the persons to determine whether a security risk exists. In one approach, the collected data is used to determine whether each person is associated with the vehicle. In response to determining that at least one of the persons is unknown, a security risk is evaluated based on data from monitoring of the environment of the vehicle. In response to determining that a security risk score exceeds a threshold, one or more actions for the vehicle are performed to make the vehicle more secure.