A security system can use video analytics and/or other input parameters to identify a theft event. Optionally, the security system can take remedial action in response. For example, the security system can use video analytics to determine that a person has reached into a shelf multiple times at a rate above a threshold, which can indicate that a thief is quickly removing items from the shelf. The security system can also use video analytics to determine that a person has reached into a shelf via a sweeping action, which can indicate that a thief is gathering and removing a large quantity of items from the shelf in one motion. In response, the security system can alert security personnel, cause a speaker to output an audible message in the target area, flag portions of the video relating to the theft event, activate or ready other sensors or systems, and/or the like.