Systems, methods, and apparatus for memory device security and row hammer mitigation are described. A control mechanism may be implemented in a front-end and/or a back-end of a memory sub-system to refresh rows of the memory. A row activation command having a row address at control circuitry of a memory sub-system and incrementing a first count of a row counter corresponding to the row address stored in a content addressable memory (CAM) of the memory sub-system may be received. Control circuitry may determine whether the first count is greater than a row hammer threshold (RHT) minus a second count of a CAM decrease counter (CDC); the second count may be incremented each time the CAM is full. A refresh command to the row address may be issued when a determination is made that the first count is greater than the RHT minus the second count.