Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a threat, the threat comprising a particular threat type, the threat indicating an incident affecting a risk value associated with an asset. The instructions cause the one or more processors to determine, based on the threat and the asset, the risk value at a first point in time, select a decay model based on the particular threat type, and update the risk value at a plurality of points in time after the first point in time with the decay model causing the risk value to decay.