A building risk analysis system including one or more memory devices storing instructions thereon, that, when executed by one or more processors, cause the one or more processors to receive threats, each of the threats including a location, wherein each of the threats are threats of a particular threat category, determine a number of threats for each of geographic areas based on the location of each of the threats, and generate a distribution based on the number of threats for each of the geographic areas. The instructions further cause the one or more processors to determine a risk score for each of the geographic areas based on one or more characteristics of the distribution and the number of threats for each of the geographic areas.