A computer security protection module arranged to provide cyber defence capabilities to a target computer resource, the target computer resource being a potential target of a cyber-attack from an attacker computer entity and the target computer resource comprising a local network and a plurality of devices connected to the local network, the module comprising: a first communications interface arranged to interface with a communications network, the attacker computer entity being remotely located from the computer resource via the communications network; a second communications interface arranged to interface with the target computer resource such that the protection module is located in a communications path between the communications network and the target computer resource; a processor arranged to inspect communications traffic between the communications network and the target computer resource; wherein, the processor is arranged to forward trusted communications traffic received at the first communications interface to the target computer resource via the second communications interface and to forward communications traffic received at the first communications interface that is not trusted to a virtual target, the virtual target being arranged to be a substantial replica of the target computer resource wherein the processor is arranged to map the architecture of the target computer resource, the map of the architecture of the target computer resource comprising configuration data relating to the target computer resource and wherein the processor is arranged to store the map of the architecture of the target computer resource, and the processor is arranged to periodically map the architecture of the target computer resource and compare to a previously stored map of the architecture of the target computer resource, the processor being arranged to output a notification message in the event of a change to the architecture of the target computer resource that does not conform to a stored security policy. a first communications interface arranged to interface with a communications network, the attacker computer entity being remotely located from the computer resource via the communications network; a second communications interface arranged to interface with the target computer resource such that the protection module is located in a communications path between the communications network and the target computer resource; a processor arranged to inspect communications traffic between the communications network and the target computer resource; wherein, the processor is arranged to forward trusted communications traffic received at the first communications interface to the target computer resource via the second communications interface and to forward communications traffic received at the first communications interface that is not trusted to a virtual target, the virtual target being arranged to be a substantial replica of the target computer resource wherein the processor is arranged to map the architecture of the target computer resource, the map of the architecture of the target computer resource comprising configuration data relating to the target computer resource and wherein the processor is arranged to store the map of the architecture of the target computer resource, and the processor is arranged to periodically map the architecture of the target computer resource and compare to a previously stored map of the architecture of the target computer resource, the processor being arranged to output a notification message in the event of a change to the architecture of the target computer resource that does not conform to a stored security policy.