BUILDING RISK ANALYSIS SYSTEM WITH RISK DECAY

1 . A building management system comprising:

one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to:

receive a threat, the threat comprising a particular threat type, the threat indicating an incident affecting a risk value associated with an asset;

determine, based on the threat and the asset, the risk value at a first point in time;

select a decay model based on the particular threat type; and

update the risk value at a plurality of points in time after the first point in time with the decay model causing the risk value to decay.

2 . The building management system of claim 1 , wherein the instructions cause the one or more processors to:

generate a list comprising a plurality of threats and the threat, each of the plurality of threats associated with a particular asset and the threat associated with the asset;

sort the list based on the risk value and a plurality of other risk values to, list the threats in order of highest risk score to lowest risk score, each of the plurality of other risk values associated with one of the plurality of threats and associated with one of the plurality of assets; and

update the sorted list as the risk value decays to list the threats in order of the highest risk score to the lowest risk score.

3 . The building management system of claim 1 , wherein the instructions cause the one or more processors to execute the instructions to select the decay model based on the particular threat type and further based on the asset.

4 . The building management system of claim 1 , wherein the instructions cause the one or more processors to select the decay model based on the particular threat type by selecting the decay model from at least one of a polynomial decay model, an exponential decay model, or a linear decay mode.

5 . The building management system of claim 1 , wherein the instructions cause the one or more processors to:

publish the risk score at each of the plurality of points in time to a risk score topic;

read the risk score topic to retrieve the risk score at each of the plurality of points in time; and

cause a user interface to display an indication of the risk score at each of the plurality of points in time based on the read of the risk score topic.

6 . The building management system of claim 1 , wherein the instructions cause the one or more processors to:

receive a plurality of threats, each of the plurality of threats comprising a particular threat type, each of the plurality of threats indicating an incident affecting a risk value associated with an asset:

determine, based on the plurality of threats and the asset, a plurality of risk values at a first point in time, each risk value associated with the asset and one of the plurality of threats select a decay model for each of the plurality of threats based on the threat type of each of the plurality of threats;

update each of the risk values at a plurality of points in time after the first point in time with the decay models selected for each of the plurality of threats; and

determine the risk value at each of the plurality of points M time associated with the asset by selecting a highest risk value from the plurality of risk values at each of the plurality of points in time.

7 . The building management system of claim 1 , wherein the instructions cause the one or more processors to determine, based on the type of the particular threat, an expiration time, wherein the expiration time indicates the length of time that the threat will affect the risk value associated with the asset;

wherein the instructions cause the one or more processors to update the risk value at the plurality of points in time after the first point in time with the decay model and the expiration time causing the risk value to decay to a particular value at an end of the expiration time.

8 . The building management system of claim 7 , wherein the instructions cause the one or more processors to update the risk value at the plurality of points in time after the first point in time with the decay model and the expiration time by:

determining, at a second point in time of the plurality of points in time after the first point in time, a decay factor based on the expiration time and the decay model; and

determining the risk value at the second point in time by multiplying the risk value at the first point in time by the decay factor.

9 . The building management system of claim 8 , wherein the instructions cause the one or more processors to:

store the threat, the expiration time, and the decay model in, the one or more computer-readable storage media; and

at each of the plurality of points in time:

retrieve the threat, the expiration time, and the decay model from the one or more computer-readable storage media;

determine, whether the threat has expired by determining whether the expiration time has passed;

determine the decay factor based on the expiration time and the decay model in response to a determination that the threat has not expired; and

determine the risk value by multiplying the risk value at a previous point in time with the decay model to determine the risk value at a current point in time.

10 . The building management system of claim 9 , wherein the instructions cause the one or more processors to:

store a threat status for the threat in the one or more computer-readable storage media, wherein the stored threat status is an active threat status indicating that the expiration time has not passed;

retrieve, at each of the plurality of points in time, the threat status; and

update the threat status stored in the one or more computer-readable storage media to dosed in response to a determination that the expiration time has passed.

11 . A method fear risk analysis, the method comprising:

receiving a threat, the threat comprising a particular threat type, the threat indicating an incident affecting a risk value associated with an asset;

determining, based on the threat and the asset, the risk value at a first point in time;

selecting a decay model based on the particular threat type; and

updating the risk value at a plurality of points in time after the first point in time with the decay model causing the risk value to decay.

12 . The method of claim 11 , further comprising:

generating a list comprising a plurality of threats and the threat, each of the plurality of threats associated with a particular asset and the threat associated with the asset;

sorting the list based on the risk value and a plurality of other risk values to list the threats in order of highest risk score to lowest risk score, each of the plurality of other risk values associated with one of the plurality of threats and associated with one of the plurality of assets; and

updating the sorted list as the risk value decays to list the threats in order of the highest risk score to the lowest risk score.

13 . The method of claim 11 , wherein determining, based on the threat and the asset, the risk value at a first point in time is based on:

a vulnerability parameter associated with the asset;

an asset cost parameter associated with the asset;

a severity associated with the threat; and

a geographic distance between the asset and the threat.

14 . The method of claim 11 , further corn selecting the decay model based on the particular threat type by selecting the decay model from at least one of a polynomial decay model, an exponential decay model, or a linear decay mode.

15 . The method of claim 11 , further comprising:

publishing the risk score at each of the plurality of points in time to a risk score topic;

reading the risk score topic to retrieve the risk score at each of the plurality of points in time; and

causing a user interface to display an indication of the risk score at each of the plurality of points in tune based on the read of the risk score topic.

16 . The method of claim 11 , further comprising:

receiving a plurality of threats, each of the plurality of threats comprising a particular threat type, each of the plurality of threats indicating ail incident affecting a risk value associated with an asset;

determining, based on the plurality of threats and the asset, a plurality of risk values at a first point in time, each risk value associated with the asset and one of the plurality of threats;

selecting a decay model for each of the plurality of threats based on the threat type of each of the plurality of threats;

updating each of the risk values at a plurality of points in time after the first point in time with die decay models selected for each of the plurality of threats; and

determining the risk value at each of the plurality of points in time associated with the asset by selecting a highest risk value from the plurality of risk values at each of the plurality of points in time.

17 . The method of claim 11 , further comprising determining, based on the type of the particular threat, an expiration time, wherein the expiration time indicates the length of time that the threat will affect the risk value associated with the asset;

wherein updating the risk value at the plurality of points in time after the first point in time comprises updating the risk value with the decay model and the expiration time causing the risk value to decay to a particular value at an end of the expiration time.

18 . The method of claim 17 , further comprising updating the risk value at the plurality of points in time after the first point in time with the decay model and the expiration time by:

determining, at a second point in time of the plurality of points in time after the first point in time, a decay factor based on the expiration time and the decay model; and determining the risk value at the second point in time by multiplying the risk value at the first point in time by the decay factor.

19 . The method of claim 18 , further comprising:

storing the threat, the expiration time, and the decay model in one or more computer-readable storage media: and

at each of the plurality of points in time:

retrieving the threat, the expiration time, and the decay model from the one or more computer-readable storage media;

determining, whether the threat has expired by determining whether the expiration time has passed;

determining the decay factor based on the expiration time and the decay model in response to a determination that the threat has not expired; and

determining the risk value by multiplying the risk value at a previous point in time with the decay model to determine the risk value at a current point in time.

20 . A risk analytics system comprising:

one or more computer-readable storage media communicably coupled to one or more processors and configured to store instructions; and

the one or more processors configured to execute the instructions to:

receive a threat, the threat comprising a particular threat type, the threat indicating an incident affecting a risk value associated with an asset;

determine, based on the threat and the asset, the risk value at a fast point in time;

select a decay model based on the particular threat type; and

update the risk value at a plurality of points in time after the first point in time, with the decay model causing the risk value to decay.