A security system to assist in identifying material of interest in articles in transit through a transit facility, the system comprising: a first detection device for obtaining detection data relating to an article in transit through the transit facility; a data store configured to store an association between each of a plurality of case identifiers and a corresponding plurality of items of case data each describing an article in transit; and a server comprising: a plurality of application programming interfaces, APIs , configured to communicate between software applications of the server , the first detection device , and the data store ; a message bus configured to provide a communication path between the plurality of APIs ; a listener coupled to the message bus and configured to obtain, from the message bus , messages sent between the APIs carrying a case identifier, and to modify the stored association based on the case identifier and case data carried by said messages; and a prediction system configured to determine, based on data stored in the association, a risk indicator for an article in transit, wherein determining the risk indicator for an article in transit comprises determining a likelihood of material of interest being present in the article; wherein the system is configured to output an alert to control inspection of an article in transit through the transit facility based on a determined risk indicator for that article. a first detection device for obtaining detection data relating to an article in transit through the transit facility; a data store configured to store an association between each of a plurality of case identifiers and a corresponding plurality of items of case data each describing an article in transit; and a server comprising: a plurality of application programming interfaces, APIs , configured to communicate between software applications of the server , the first detection device , and the data store ; a message bus configured to provide a communication path between the plurality of APIs ; a listener coupled to the message bus and configured to obtain, from the message bus , messages sent between the APIs carrying a case identifier, and to modify the stored association based on the case identifier and case data carried by said messages; and a prediction system configured to determine, based on data stored in the association, a risk indicator for an article in transit, wherein determining the risk indicator for an article in transit comprises determining a likelihood of material of interest being present in the article; a plurality of application programming interfaces, APIs , configured to communicate between software applications of the server , the first detection device , and the data store ; a message bus configured to provide a communication path between the plurality of APIs ; a listener coupled to the message bus and configured to obtain, from the message bus , messages sent between the APIs carrying a case identifier, and to modify the stored association based on the case identifier and case data carried by said messages; and a prediction system configured to determine, based on data stored in the association, a risk indicator for an article in transit, wherein determining the risk indicator for an article in transit comprises determining a likelihood of material of interest being present in the article; wherein the system is configured to output an alert to control inspection of an article in transit through the transit facility based on a determined risk indicator for that article. <EOS>