diff --git a/util/secscan/api.py b/util/secscan/api.py
index 5c242f46a..84a16ad8b 100644
--- a/util/secscan/api.py
+++ b/util/secscan/api.py
@@ -288,30 +288,39 @@ class SecurityScannerAPI(object):
     return self._get_layer_data(layer_id, include_features, include_vulnerabilities)
 
   def _get_layer_data(self, layer_id, include_features=False, include_vulnerabilities=False):
+    params = {}
+    if include_features:
+      params = {'features': True}
+
+    if include_vulnerabilities:
+      params = {'vulnerabilities': True}
+
     try:
-      params = {}
-      if include_features:
-        params = {'features': True}
-
-      if include_vulnerabilities:
-        params = {'vulnerabilities': True}
-
       response = self._call('GET', _API_METHOD_GET_LAYER % layer_id, params=params)
       logger.debug('Got response %s for vulnerabilities for layer %s',
                    response.status_code, layer_id)
-      json_response = response.json()
+      if response.status_code == 404:
+        return None
+      elif response.status_code // 100 == 5:
+        logger.error(
+          'downstream security service failure: status %d, text: %s',
+          response.status_code,
+          response.text,
+        )
+        raise APIRequestFailure('Downstream service returned 5xx')
     except requests.exceptions.Timeout:
       raise APIRequestFailure('API call timed out')
     except requests.exceptions.ConnectionError:
       raise APIRequestFailure('Could not connect to security service')
-    except (requests.exceptions.RequestException, ValueError):
+    except requests.exceptions.RequestException:
       logger.exception('Failed to get layer data response for %s', layer_id)
       raise APIRequestFailure()
 
-    if response.status_code == 404:
-      return None
+    try:
+      return response.json()
+    except ValueError:
+      logger.exception('Failed to decode response JSON')
 
-    return json_response
 
   def _request(self, method, endpoint, path, body, params, timeout):
     """ Issues an HTTP request to the security endpoint. """