This paper presents a mathematical graph-based model for use in automated security analysis systems. The model allows to link information about the system obtained by a specialist in the process of security analysis with a set of attack scenarios in which it may be involved. Executing  each scenario results in new portion of data, that describes some system component and contributes to the expansion of the attack graph.