diff --git a/src/core/thread/tmf.cpp b/src/core/thread/tmf.cpp
index f24dd2235..fae6d5c62 100644
--- a/src/core/thread/tmf.cpp
+++ b/src/core/thread/tmf.cpp
@@ -173,10 +173,16 @@ Error Agent::Filter(void *aContext, const Msg &aRxMsg) { return static_cast<Agen
 
 Error Agent::Filter(const Msg &aRxMsg) const
 {
-    return IsTmfMessage(aRxMsg.mMessageInfo.GetPeerAddr(), aRxMsg.mMessageInfo.GetSockAddr(),
-                        aRxMsg.mMessageInfo.GetSockPort())
-               ? kErrorNone
-               : kErrorNotTmf;
+    Error error = kErrorNone;
+
+    VerifyOrExit(IsTmfMessage(aRxMsg.mMessageInfo.GetPeerAddr(), aRxMsg.mMessageInfo.GetSockAddr(),
+                              aRxMsg.mMessageInfo.GetSockPort()),
+                 error = kErrorNotTmf);
+
+    VerifyOrExit(aRxMsg.mMessage.IsLinkSecurityEnabled(), error = kErrorSecurity);
+
+exit:
+    return error;
 }
 
 bool Agent::IsTmfMessage(const Ip6::Address &aSourceAddress, const Ip6::Address &aDestAddress, uint16_t aDestPort) const