Abstract: Systems and methods for identifying at risk building sites. The security system includes a processing circuit configured to receive building security data from the plurality of building sites, the building security data indicating one or more vulnerability time periods for each of the plurality of building sites and determine an average vulnerability time period associated with each of the plurality building sites based on the one or more vulnerability time periods. The processing circuit can also be configured to determine a tunable threshold associated with the average vulnerability time period; determine whether each of the plurality of building sites are at risk by determining whether a current vulnerability time period for each building site is greater than the tunable threshold associated with the average vulnerability time period; and generate a report indicating one or more of the plurality of building sites that are at risk.