diff --git a/modules/security/suspicious-login-monitor.sh b/modules/security/suspicious-login-monitor.sh
index 1e5633e..2d3f090 100755
--- a/modules/security/suspicious-login-monitor.sh
+++ b/modules/security/suspicious-login-monitor.sh
@@ -1786,9 +1786,9 @@ check_recent_password_changes() {
                 local base_risk=5
                 [ "$admin_active" -eq 1 ] && base_risk=2
                 [ "$safe_window" -eq 1 ] && base_risk=2
-                [ "$has_tty" -eq 1 ] && base_risk=$((base_risk < 2 ? base_risk : base_risk - 1))
-                [ "$login_recent" -eq 1 ] && base_risk=$((base_risk < 2 ? base_risk : base_risk - 1))
-                [ "$in_maintenance" -eq 1 ] && base_risk=$((base_risk < 2 ? base_risk : base_risk - 1))
+                [ "$has_tty" -eq 1 ] && [ "$base_risk" -gt 1 ] && base_risk=$((base_risk - 1))
+                [ "$login_recent" -eq 1 ] && [ "$base_risk" -gt 1 ] && base_risk=$((base_risk - 1))
+                [ "$in_maintenance" -eq 1 ] && [ "$base_risk" -gt 1 ] && base_risk=$((base_risk - 1))
                 risk=$((risk + base_risk))
                 details="${details}Single-user:$filtered_users "
             else