A Cyber Vulnerability Assessment Tool (CVAST) and CVAST Threat Assessment Heuristic (CVAST THRASH) capable of automated modeling of cyber physical systems, assessment of the nature of cyber risks thereto, and output of such cyber risk assessments are provided.