Systems and methods for predicting and increasing the threat level at ATM centers prior to alarm event detection are provided. Some methods can include receiving a first signal from an ATM machine indicative of whether the ATM machine dispenses cash, receiving a second signal from a people counter indicative of persons entering or exiting a region in which the ATM machine is located, and responsive to the first signal or the second signal, determining whether to increase a threat level associated with the ATM machine irrespective of detecting an alarm event associated with the ATM machine.