A system for threat determination, comprising: a) at least one replica programmable logic controller that corresponds to a production PLC in a production system that includes a plurality of PLC controlled hardware components, wherein the at least one replica PLC is configured to operate at an accelerated processing speed that is at least two times faster than a processing speed of the production PLC in the production system, b) at least one data processing system, including at least one processor configured to: b1) communicate with the at least one replica PLC when the at least one replica PLC is executing malware infected PLC firmware; b2) generate a first simulation of the production system based on a virtual model of the production system operating at an accelerated processing speed that is at least two times faster than a processing speed of the physical production system, wherein the first simulation includes accelerated simulation of the production PLC based on communication with the at least one replica PLC using the malware infected PLC firmware; b3) monitor outputs from the at least one replica PLC and the first simulation of the production system to determine at least one possible threat to at least one hardware component of the production system caused by the production PLC executing the infected PLC firmware rather than a non-infected PLC firmware; and b4) output data indicative of the at least one possible threat through at least one display device. a) at least one replica programmable logic controller that corresponds to a production PLC in a production system that includes a plurality of PLC controlled hardware components, wherein the at least one replica PLC is configured to operate at an accelerated processing speed that is at least two times faster than a processing speed of the production PLC in the production system, b) at least one data processing system, including at least one processor configured to: b1) communicate with the at least one replica PLC when the at least one replica PLC is executing malware infected PLC firmware; b2) generate a first simulation of the production system based on a virtual model of the production system operating at an accelerated processing speed that is at least two times faster than a processing speed of the physical production system, wherein the first simulation includes accelerated simulation of the production PLC based on communication with the at least one replica PLC using the malware infected PLC firmware; b3) monitor outputs from the at least one replica PLC and the first simulation of the production system to determine at least one possible threat to at least one hardware component of the production system caused by the production PLC executing the infected PLC firmware rather than a non-infected PLC firmware; and b4) output data indicative of the at least one possible threat through at least one display device. b1) communicate with the at least one replica PLC when the at least one replica PLC is executing malware infected PLC firmware; b2) generate a first simulation of the production system based on a virtual model of the production system operating at an accelerated processing speed that is at least two times faster than a processing speed of the physical production system, wherein the first simulation includes accelerated simulation of the production PLC based on communication with the at least one replica PLC using the malware infected PLC firmware; b3) monitor outputs from the at least one replica PLC and the first simulation of the production system to determine at least one possible threat to at least one hardware component of the production system caused by the production PLC executing the infected PLC firmware rather than a non-infected PLC firmware; and b4) output data indicative of the at least one possible threat through at least one display device.