A security system to assist in identifying material of interest in articles in transit through a transit facility, the system comprising: a first detection device (11, 12, 13) for obtaining detection data relating to an article in transit through the transit facility; a data store configured to store an association between each of a plurality of case identifiers and a corresponding plurality of items of case data each describing an article in transit; and a server comprising: a plurality of application programming interfaces, APIs (111, 112, 113), configured to communicate between software applications (121, 122, 123) of the server, the first detection device (11, 12, 13), and the data store; a message bus configured to provide a communication path between the plurality of APIs (111, 112, 113); a listener coupled to the message bus and configured to obtain, from the message bus, messages sent between the APIs (111, 112, 113) carrying a case identifier, and to modify the stored association based on the case identifier and case data carried by said messages; and a prediction system configured to determine, based on data stored in the association, a risk indicator for an article in transit, wherein determining the risk indicator for an article in transit comprises determining a likelihood of material of interest being present in the article; wherein the system is configured to output an alert to control inspection of an article in transit through the transit facility based on a determined risk indicator for that article. a first detection device (11, 12, 13) for obtaining detection data relating to an article in transit through the transit facility; a data store configured to store an association between each of a plurality of case identifiers and a corresponding plurality of items of case data each describing an article in transit; and a server comprising: a plurality of application programming interfaces, APIs (111, 112, 113), configured to communicate between software applications (121, 122, 123) of the server, the first detection device (11, 12, 13), and the data store; a message bus configured to provide a communication path between the plurality of APIs (111, 112, 113); a listener coupled to the message bus and configured to obtain, from the message bus, messages sent between the APIs (111, 112, 113) carrying a case identifier, and to modify the stored association based on the case identifier and case data carried by said messages; and a prediction system configured to determine, based on data stored in the association, a risk indicator for an article in transit, wherein determining the risk indicator for an article in transit comprises determining a likelihood of material of interest being present in the article; a plurality of application programming interfaces, APIs (111, 112, 113), configured to communicate between software applications (121, 122, 123) of the server, the first detection device (11, 12, 13), and the data store; a message bus configured to provide a communication path between the plurality of APIs (111, 112, 113); a listener coupled to the message bus and configured to obtain, from the message bus, messages sent between the APIs (111, 112, 113) carrying a case identifier, and to modify the stored association based on the case identifier and case data carried by said messages; and a prediction system configured to determine, based on data stored in the association, a risk indicator for an article in transit, wherein determining the risk indicator for an article in transit comprises determining a likelihood of material of interest being present in the article; wherein the system is configured to output an alert to control inspection of an article in transit through the transit facility based on a determined risk indicator for that article.