Example implementations include aspects for controlling a security system monitoring an environment, comprising collecting sensor data from a plurality of sensors located in the environment, and determining whether a plurality of characteristics of a security event are present in the environment. A determination for each characteristic includes a confidence score indicative of a likelihood that the characteristic is present. The aspects further include identifying, from a plurality of pre-determined environment states, a state of the environment based on a current time and an event schedule of the environment, and generating a combined score that is a function of each respective confidence score and a plurality of weights, wherein each weight corresponds to a respective characteristic and has a value based on the state of the environment. The implementations further include determining that the combined score is greater than a threshold score, and generating an alert indicative of the security event.