An aggregated model based on technical diagnostics principles is proposed, allowing system states to be classified by their level of technical operability and security. Formal metrics are introduced for quantitatively assessing the security of automated systems. It is shown that countering attacks targeting vulnerabilities in software update subsystems requires the development of new methods for identifying dangerous configuration states.