receiving, at a metrology unit of a meter device, first electrical data from one or more sensors indicating first electrical usage over a first time period, the first electrical data comprising frequency domain data;

comparing, as a comparison and at a behavior component of the meter device, the first electrical data to second electrical data associated with second electrical usage over a second time period, the second time period prior to the first time period;

determining, based at least in part on the comparison, that a connection to an electrical power supply is unstable and represents a potential electrical threat;

receiving, at the metrology unit of the meter device, third electrical data from the one or more sensors indicating third electrical usage over a third time period after the first time period;

comparing, at the behavior component of the meter device, values associated with the third electrical data to a threshold value utilizing a first algorithm of multiple algorithms;

based at least in part on a result of comparing the values associated with the third electrical data to the threshold value, sending a message, indicating the potential electrical threat and including data associated with the result, through one or more networks to a computing device remote from the meter device;

receiving, by the meter device from the computing device, a confirmation of the potential electrical threat, the confirmation determined by the computing device, based on the data associated with the result and additional electrical data from one or more meter devices different from the meter device, utilizing a second algorithm of the multiple algorithms, the second algorithm different from the first algorithm; and

in response to receiving the confirmation, disconnecting, by a service switch associated with the meter device, the connection to the electrical power supply.