A security controller has first and second read request paths for performing security checking of read requests received from a master device and for controlling issuing of the read request to a safe device. If the first read request path is selected for an incoming read request then the first read request path controls issuing of the read request in dependence on result of the security checking. If the second read request path is selected, then the incoming read request is issued without waiting for a result of the security checking, and tracking data is stored indicating the result of the security checking. When receiving a response to a read request issued using the second read request path, a response path modifies the response to mask read data if the tracking data stored for the corresponding read request indicates that a security violation occurred.