A method at a computing device for determining processing characteristics of nodes (320, 322, 324) within a system, the method comprising the computing device: receiving a plurality of messages being passed within the system, wherein the plurality of messages are passed on a Controller Area Network, CAN, bus; performing a dynamic analysis of the system, the dynamic analysis comprising analyzing a payload for each message of the plurality of messages, wherein analyzing the payload for each message comprises determining one or more message identifiers associated with corresponding one or more of the plurality of messages, wherein the one or more message identifiers are standard or extended CAN identifiers; performing a static analysis of the system, the static analysis comprising performing an analysis of a binary image for each node within the system to find nodes performing acceptance filtering for the one or more message identifiers, wherein performing an analysis of a binary image comprises identifying at least one message identifier filter within the binary image, the at least one identifier filter being indicative of whether a node is configured to accept the one or more of the plurality of messages associated with the one or more message identifiers; determining, for each of the nodes performing acceptance filtering, the message traffic directed to that node by correlating said node with the plurality of messages associated with the one or more message identifiers which the node is configured to accept; determining a relative amount of processing done by each of the nodes based on the message traffic directed to that node, wherein the determining of the relative amount of processing ranks each node within the system based on an amount of processing performed at that node; and performing vulnerability analysis for each node in the system in an order based on the rank of each node. receiving a plurality of messages being passed within the system, wherein the plurality of messages are passed on a Controller Area Network, CAN, bus; performing a dynamic analysis of the system, the dynamic analysis comprising analyzing a payload for each message of the plurality of messages, wherein analyzing the payload for each message comprises determining one or more message identifiers associated with corresponding one or more of the plurality of messages, wherein the one or more message identifiers are standard or extended CAN identifiers; performing a static analysis of the system, the static analysis comprising performing an analysis of a binary image for each node within the system to find nodes performing acceptance filtering for the one or more message identifiers, wherein performing an analysis of a binary image comprises identifying at least one message identifier filter within the binary image, the at least one identifier filter being indicative of whether a node is configured to accept the one or more of the plurality of messages associated with the one or more message identifiers; determining, for each of the nodes performing acceptance filtering, the message traffic directed to that node by correlating said node with the plurality of messages associated with the one or more message identifiers which the node is configured to accept; determining a relative amount of processing done by each of the nodes based on the message traffic directed to that node, wherein the determining of the relative amount of processing ranks each node within the system based on an amount of processing performed at that node; and performing vulnerability analysis for each node in the system in an order based on the rank of each node.