diff --git a/src/fu-security-attr.c b/src/fu-security-attr.c
index 046ed9f70..ea28a018d 100644
--- a/src/fu-security-attr.c
+++ b/src/fu-security-attr.c
@@ -181,9 +181,8 @@ fu_security_attr_get_name(FwupdSecurityAttr *attr)
 }
 
 const gchar *
-fu_security_attr_get_result(FwupdSecurityAttr *attr)
+fu_security_attr_result_to_string(FwupdSecurityAttrResult result)
 {
-	FwupdSecurityAttrResult result = fwupd_security_attr_get_result(attr);
 	if (result == FWUPD_SECURITY_ATTR_RESULT_VALID) {
 		/* TRANSLATORS: Suffix: the HSI result */
 		return _("Valid");
@@ -240,6 +239,18 @@ fu_security_attr_get_result(FwupdSecurityAttr *attr)
 		/* TRANSLATORS: Suffix: the HSI result */
 		return _("Not supported");
 	}
+	return NULL;
+}
+
+const gchar *
+fu_security_attr_get_result(FwupdSecurityAttr *attr)
+{
+	const gchar *tmp;
+
+	/* common case */
+	tmp = fu_security_attr_result_to_string(fwupd_security_attr_get_result(attr));
+	if (tmp != NULL)
+		return tmp;
 
 	/* fallback */
 	if (fwupd_security_attr_has_flag(attr, FWUPD_SECURITY_ATTR_FLAG_SUCCESS)) {
diff --git a/src/fu-security-attr.h b/src/fu-security-attr.h
index 62df6708a..c02aaf83b 100644
--- a/src/fu-security-attr.h
+++ b/src/fu-security-attr.h
@@ -25,3 +25,5 @@ gboolean
 fu_security_attrs_equal(FuSecurityAttrs *attrs1, FuSecurityAttrs *attrs2);
 GPtrArray *
 fu_security_attrs_compare(FuSecurityAttrs *attrs1, FuSecurityAttrs *attrs2);
+const gchar *
+fu_security_attr_result_to_string(FwupdSecurityAttrResult result);
diff --git a/src/fu-util-common.c b/src/fu-util-common.c
index e5706c89c..75680c86e 100644
--- a/src/fu-util-common.c
+++ b/src/fu-util-common.c
@@ -1986,6 +1986,10 @@ fu_util_security_event_to_string(FwupdSecurityAttr *attr)
 		      FWUPD_SECURITY_ATTR_RESULT_NOT_TAINTED,
 		      FWUPD_SECURITY_ATTR_RESULT_TAINTED,
 		      NULL},
+		     {"org.fwupd.hsi.Fwupd.Plugins",
+		      FWUPD_SECURITY_ATTR_RESULT_UNKNOWN,
+		      FWUPD_SECURITY_ATTR_RESULT_NOT_ENABLED,
+		      NULL},
 		     /* ------------------------------------------*/
 		     {"org.fwupd.hsi.Kernel.Lockdown",
 		      FWUPD_SECURITY_ATTR_RESULT_ENABLED,
@@ -2013,6 +2017,9 @@ fu_util_security_event_to_string(FwupdSecurityAttr *attr)
 	/* sanity check */
 	if (fwupd_security_attr_get_appstream_id(attr) == NULL)
 		return NULL;
+	if (fwupd_security_attr_get_result(attr) == FWUPD_SECURITY_ATTR_RESULT_UNKNOWN &&
+	    fwupd_security_attr_get_result_fallback(attr) == FWUPD_SECURITY_ATTR_RESULT_UNKNOWN)
+		return NULL;
 
 	/* look for prepared text */
 	for (guint i = 0; items[i].appstream_id != NULL; i++) {
@@ -2023,12 +2030,35 @@ fu_util_security_event_to_string(FwupdSecurityAttr *attr)
 			return g_strdup(items[i].text);
 	}
 
+	/* disappeared */
+	if (fwupd_security_attr_get_result(attr) == FWUPD_SECURITY_ATTR_RESULT_UNKNOWN) {
+		return g_strdup_printf(
+		    /* TRANSLATORS: %1 refers to some kind of security test, e.g. "SPI BIOS region".
+		       %2 refers to a result value, e.g. "Invalid" */
+		    _("%s disappeared: %s"),
+		    fu_security_attr_get_name(attr),
+		    fu_security_attr_result_to_string(
+			fwupd_security_attr_get_result_fallback(attr)));
+	}
+
+	/* appeared */
+	if (fwupd_security_attr_get_result_fallback(attr) == FWUPD_SECURITY_ATTR_RESULT_UNKNOWN) {
+		return g_strdup_printf(
+		    /* TRANSLATORS: %1 refers to some kind of security test, e.g. "Encrypted RAM".
+		       %2 refers to a result value, e.g. "Invalid" */
+		    _("%s appeared: %s"),
+		    fu_security_attr_get_name(attr),
+		    fu_security_attr_result_to_string(fwupd_security_attr_get_result(attr)));
+	}
+
 	/* fall back to something sensible */
 	return g_strdup_printf(
-	    _("Attribute '%s' changed result from %s to %s."),
-	    fwupd_security_attr_get_name(attr),
-	    fwupd_security_attr_result_to_string(fwupd_security_attr_get_result_fallback(attr)),
-	    fwupd_security_attr_result_to_string(fwupd_security_attr_get_result(attr)));
+	    /* TRANSLATORS: %1 refers to some kind of security test, e.g. "UEFI platform key".
+	     * %2 and %3 refer to results value, e.g. "Valid" and "Invalid" */
+	    _("%s changed: %s → %s"),
+	    fu_security_attr_get_name(attr),
+	    fu_security_attr_result_to_string(fwupd_security_attr_get_result_fallback(attr)),
+	    fu_security_attr_result_to_string(fwupd_security_attr_get_result(attr)));
 }
 
 gchar *