1. A device, comprising: one or more processors to: receive usage information associated with a group of client networks and a same particular time period, the usage information including particular usage information associated with a particular client network of the group of client networks; receive threat information associated with the group of client networks, the threat information including particular threat information associated with the particular client network; determine a usage baseline for the group of client networks over the same particular time period based on respective usage information, of the usage information, over the same particular time period for each client network included in the group of client networks; determine a normalization function, associated with the particular client network, based on the usage baseline for the group of client networks and the particular usage information associated with the particular client network; determine normalized threat information, associated with the particular client network over the same particular time period, based on the normalization function and the particular threat information; determine overall normalized threat information associated with the group of client networks over the same particular time period based on the usage information, where the one or more processors, when determining the overall normalized threat information, are to: determine a group of normalization functions, the group of normalization functions including the normalization function, determine group normalized threat information, associated with the group of client networks, based on the group of normalization functions and the threat information, compute mean normalized threat information based on the group normalized threat information associated with the group of client networks, and determine the overall normalized threat information as a value equal to the mean normalized threat information; and provide a threat assessment associated with the particular client network based on the normalized threat information, associated with the particular client network, and the overall normalized threat information associated with the group of client networks.