A security device includes a controller configured to determine a flow identifier and an event counter associated with a received data packet and a counter memory including multiple memory banks where each memory bank stores a partial counter value for one or more event counters. The counter memory is indexed by a counter identifier associated with the event counter. A memory controller selects a memory bank in the counter memory that was not the memory bank last selected and the partial counter value associated with the counter identifier in the selected memory bank is updated, the updated partial counter value being written back to the selected memory bank. In one embodiment, the partial counter value is updated and written back within the latency window of the memory bank last selected.