An analyzer operative to perform threat detection for a system that comprises a physical subsystem having a plurality of controllable devices (11, 12) and a cyber subsystem associated with the physical subsystem, the analyzer comprising: at least one interface operative to receive - cyber security information from an intrusion detection system associated with the cyber subsystem and - physical subsystem information related to the physical subsystem; and at least one integrated circuit coupled to the at least one interface and operative to process, in combination, the cyber security information and the physical subsystem information to perform the threat detection; wherein the analyzer is operative to determine related sets of features from a data collector, the data collector being adapted to collect information about the physical subsystem and to forward this information to the analyser; and the analyzer is operative to report results of the threat detection in response to any one or any combination of the following: - a feature set has a minimum distance to a feature set that is known to have a security threat, the distance between feature sets being determined using a distance metric in a feature space spanned by the variables of the feature sets; - a point in feature space representing the feature set moves, as a function of time, in a direction towards a point in feature space representing a feature set that is known to have a security threat; - a point in feature space associated with the feature set moves, as a function of time, in a direction away from all points in feature space representing previously recorded feature sets; - the feature set is inconsistent with a cyber security status. at least one interface operative to receive - cyber security information from an intrusion detection system associated with the cyber subsystem and - physical subsystem information related to the physical subsystem; and - cyber security information from an intrusion detection system associated with the cyber subsystem and - physical subsystem information related to the physical subsystem; and at least one integrated circuit coupled to the at least one interface and operative to process, in combination, the cyber security information and the physical subsystem information to perform the threat detection; wherein the analyzer is operative to determine related sets of features from a data collector, the data collector being adapted to collect information about the physical subsystem and to forward this information to the analyser; and the analyzer is operative to report results of the threat detection in response to any one or any combination of the following: - a feature set has a minimum distance to a feature set that is known to have a security threat, the distance between feature sets being determined using a distance metric in a feature space spanned by the variables of the feature sets; - a point in feature space representing the feature set moves, as a function of time, in a direction towards a point in feature space representing a feature set that is known to have a security threat; - a point in feature space associated with the feature set moves, as a function of time, in a direction away from all points in feature space representing previously recorded feature sets; - the feature set is inconsistent with a cyber security status. - a feature set has a minimum distance to a feature set that is known to have a security threat, the distance between feature sets being determined using a distance metric in a feature space spanned by the variables of the feature sets; - a point in feature space representing the feature set moves, as a function of time, in a direction towards a point in feature space representing a feature set that is known to have a security threat; - a point in feature space associated with the feature set moves, as a function of time, in a direction away from all points in feature space representing previously recorded feature sets; - the feature set is inconsistent with a cyber security status.