Models of possible attacks and defenses can help assess and improve an organization’s cybersecurity posture. However, existing models for analyzing cybersecurity fail to adequately model the temporal aspects of attacks and defenses. For example, game-theoretic models typically assume that the players (here, the attacker and the defender) take turns, and the effect of an action realizes immediately. In reality, attacker and defender actions may start asynchronously at any time and may have very different duration. This has important consequences. For example, whether the defender can successfully thwart an attack may depend on whether the defender can finish implementing a mitigation action before the attack would reach its goal. This paper proposes a new, formal model of cybersecurity attacks and defense, with a special focus on the time dimension. The model allows reasoning about temporal aspects, such as how the duration of defensive actions impacts their ability to prevent attacks. Based on the proposed formal model, we develop a simulator that supports easy experimentation and what-if analysis with different attack and defense strategies.