“…While useful in many types of scenarios [69], most of them are focused on OR-only graph-based models for IT networks and do not cover AND/OR semantics. Other important approaches targeting cyber-physical systems include probabilistic model checking and formal methods [30,42,73,78], security metrics and graph-based methods [34,61,70,72], system design analysis [19], real-time monitoring [12,38], structural controllability aspects [3,52,58,60], among others. The focus of this work is on the identification of CPS components that are most likely to jeopardise the system's mission.…”