Threat assessment of software-configured system based upon architecture model and as-built code

A method comprising: providing in a non-transitory machine readable storage device a first information structure that includes respective elements that each respectively represent one or more components or communication channels or a combination thereof of a system that includes one or more machines configured with computer software; wherein the first information structure associates at least one element with at least one of an attribute indicative of a mitigation of at least one known vulnerability of the at least one component or communication channel or combination thereof represented by the at least one element; using a computer system to produce and to store within a non-transitory machine readable storage device an analysis of as-built code used to configure one or more machines to implement the system; wherein the produced analysis includes an output log with respective entries that include respective code references and respective indicia of attributes corresponding to respective observation points within the as-built code that correspond respective elements of the first information structure; mapping at least one respective entry to at least one element of the first information structure; and associating an attribute included within the at least one entry with an attribute associated within the first information structure with the at least one element.