Computer-implemented method for determining a threat situation for an automation component within a control and monitoring system, - wherein the automation component comprises inputs and outputs, - wherein the automation component has at least one essentially cyclic program behaviour, - wherein process states at the inputs of the automation component are cyclically read in and the outputs of the automation component are output cyclically and in correlation with the cyclic reading-in, - wherein the program of the automation component creates a specific output process image for a specific input process image, - whereby there is a process image for each of the process states at the input and at the output of the automation component, which defines an actual program behaviour during operation of the system, - wherein a number of required program behaviours are determined and stored, before a monitoring takes place, - wherein the required program behaviours in each case correspond to the process states read in as part of a respective cycle and to the correlating outputs under the prerequisite that the automation component is free from any manipulations, and in order to monitor the program behaviour comprising: a) cyclic establishment of at least one actual program behaviour; b) cyclic comparison of the actual program behaviour with the available required program behaviours; c) cyclic derivation of a threat situation from the comparison; d) in the event of a threat situation, alarm signalling of the threat situation. - wherein the automation component comprises inputs and outputs, - wherein the automation component has at least one essentially cyclic program behaviour, - wherein process states at the inputs of the automation component are cyclically read in and the outputs of the automation component are output cyclically and in correlation with the cyclic reading-in, - wherein the program of the automation component creates a specific output process image for a specific input process image, - whereby there is a process image for each of the process states at the input and at the output of the automation component, which defines an actual program behaviour during operation of the system, - wherein a number of required program behaviours are determined and stored, before a monitoring takes place, - wherein the required program behaviours in each case correspond to the process states read in as part of a respective cycle and to the correlating outputs under the prerequisite that the automation component is free from any manipulations, and in order to monitor the program behaviour comprising: a) cyclic establishment of at least one actual program behaviour; b) cyclic comparison of the actual program behaviour with the available required program behaviours; c) cyclic derivation of a threat situation from the comparison; d) in the event of a threat situation, alarm signalling of the threat situation. a) cyclic establishment of at least one actual program behaviour; b) cyclic comparison of the actual program behaviour with the available required program behaviours; c) cyclic derivation of a threat situation from the comparison; d) in the event of a threat situation, alarm signalling of the threat situation.