Systems and methods are disclosed for detecting security threats in a network environment. A local workstation is used to inspect an item and submit a request for assistance to determine whether the item raises a security threat. A server receives the request for assistance from the local workstation over a network and retrieves a dialing plan associated with the origin of the request. The server utilizes the dialing plan to route the request to expert groups assigned to the dialing group. In response to the request being accepted by a remote expert device in one of the expert groups, the server establishes a connection between the local workstation and the remote expert device that accepted the request.