The various implementations described herein include methods, devices and systems for detecting trigger events and executing security protocols. In one aspect, a method is performed at a server system that is coupled to a smart device system and a client device, the smart device system located at a premises. The server system: (1) detects an unverified user within the premises based on data collected by the smart device system, wherein the data is communicated to the server system via the wide area networks; (2) provides a notification regarding the unverified user to authorized users via the wide area networks; (3) receives, from a first authorized user, a first user input in response to the notification; and (4) in response to receiving the first user input, executes a security operation at the premises based on the first user input.