Security rules of a security system include original security scores as conditions for raising alerts. The original security scores are dependent on the underlying scoring mechanism of the security system. When the scoring mechanism is updated to produce new security scores, the security rules are updated ensuring that the alert rates associated with the original security scores match the alert rates associated with the new security scores, which replace the original security scores in the security rules.