A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a plurality of threat events, the received threat events associated with a plurality of threat categories, the plurality of assets associated with a plurality of locations. The instructions cause the one or more processors to generate a location-specific aggregated risk score, generate a category-specific risk metric indicating, and for each of at least two or more of the plurality of threat categories, generate a number of threat events associated with the threat categories, generate user interface data including, within a single interface, visual representations of both the location-specific aggregated risk scores for the two or more locations and the category-specific risk metrics for the two or more threat categories.