A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a plurality of threats, the plurality of threats comprising a first threat and a second threat, the first threat and the second threat affecting a risk score of an asset and determine whether the first threat is correlated with the second threat. The instructions cause the one or more processors to determine a value of the risk score to be a first value in response to a determination that the first threat is correlated with the second threat and determine the value of the risk score to be a second value in response to a determination that the first threat is not correlated with the second threat.