A system comprises an enclosure, host logic contained in the enclosure, and intrusion security logic also contained in the enclosure. The intrusion security logic is coupled to the host logic and configured to detect a security intrusion to the system and to respond to a security intrusion with a user-configurable trigger event. The intrusion security logic implements at least two tamper blocks, each tamper block configured to monitor one more input signals and initiate a trigger event when a security breach of the enclosure is detected. At least one of the tamper blocks comprises a state machine whose operation is controlled by way of user-programmable registers.