The security of cyber-physical systems depends in a complex way on factors of the information and natural environment. The time factor has a significant influence. Developing a forecast for the occurrence of dangerous situations and measures to block them in such conditions is a difficult task. The complexity is due to the ambiguity and uncertainty of assessing the state of a cyber-physical system. In this case, it seems rational to use the methodology for organizing intelligent systems. In this paper, we propose a method based on a special model for representing the experience of precedent analysis and a model of a fuzzy periodic graph. The precedent of experience is described by a two-component model that includes the center and the admissible transformations of the center in a given semantic context. The center is a space-time situation that reflects the connections and relationships between information objects. Permissible transformations are a set of areas of possible location of objects and connections in the spatio-temporal boundaries of a cyber-physical object. The search for a solution to block the threat is based on a comparison of known and problematic situations. A distinctive feature of comparison is the transformation of a known situation into an analyzed location. This is implemented by estimating the connectivity and reachability of the vertices of the fuzzy graph of objects and relations of the known precedent. Connectivity is interpreted as a necessary condition for the implementation of the threat. Reachability displays vulnerabilities that can provoke a threat. The proposed method can be used both for classifying anomalous states and for constructing solutions when incidents occur. The limits of practical applicability of the proposed method are discussed. An example of application is considered.