A computer implemented method of protecting a portion of computer network from malware attack, the computer network comprising network connected devices organised in a hierarchy of subnets modelled by a tree data structure in which each subnet is represented as a node in the tree, each node having a connection to a parent node save for a root node, the method comprising: generating a model of each subnet in the hierarchy of subnets of the computer network as a dynamical system, each dynamical system modelling a rate of change of a number of network connected devices in the subnet that are: susceptible to infection by the malware; infected by the malware; protected against infection by the malware; and remediated of infection by the malware, the dynamical system being based on rates of transmission of the malware between all pairs of subnets; evaluating, for each subnet in the network, a risk of infection for the subnet at a predetermined point in time based on the dynamical systems and associating the risk of infection with a node in the tree corresponding to the subnet; identifying a first subset of nodes in the tree data structure for which a risk of infection is below a predetermined threshold level of risk; identifying a second subset of nodes in the tree data structure as a subset of the first subset, the second subset comprising nodes having a connection to a node in the tree data structure having a risk of infection meeting or exceeding the predetermined threshold level of risk; and performing protective actions on devices in subnets associated with the first subset of nodes to provide protection against the malware, prioritising devices in the subnets associated with the second subset of nodes so as to provide a barrier of subnets protected against the malware to impede the propagation of the malware to devices in subnets associated with the first subset of nodes. generating a model of each subnet in the hierarchy of subnets of the computer network as a dynamical system, each dynamical system modelling a rate of change of a number of network connected devices in the subnet that are: susceptible to infection by the malware; infected by the malware; protected against infection by the malware; and remediated of infection by the malware, the dynamical system being based on rates of transmission of the malware between all pairs of subnets; evaluating, for each subnet in the network, a risk of infection for the subnet at a predetermined point in time based on the dynamical systems and associating the risk of infection with a node in the tree corresponding to the subnet; identifying a first subset of nodes in the tree data structure for which a risk of infection is below a predetermined threshold level of risk; identifying a second subset of nodes in the tree data structure as a subset of the first subset, the second subset comprising nodes having a connection to a node in the tree data structure having a risk of infection meeting or exceeding the predetermined threshold level of risk; and performing protective actions on devices in subnets associated with the first subset of nodes to provide protection against the malware, prioritising devices in the subnets associated with the second subset of nodes so as to provide a barrier of subnets protected against the malware to impede the propagation of the malware to devices in subnets associated with the first subset of nodes.