A security system for a network may be configured to detect one or more failed authentication attempts to access the network by at least one user device and determine the number of the failed authentication attempts. The system may determine a first risk score based on the number of failed authentication attempts and determine whether the first risk score is greater than or equal to a first risk score threshold and generate a first notification indicating that the user device is attempting to gain unauthorized access onto the network. The system may transmit the first notification to an administrator of the network, determine the user device is successfully authenticated to access the network after the number of failed authentication attempts has been detected, and apply a first set of network activity restrictions to the user device.