Responding to threats to information security in cyber-physical systems is associated with the accumulation of knowledge about the precedents of violations. The factors of influence are both informational and spatiotemporal objects and relationships. Information processes significantly depend on the information generated by sensors, as well as transmitted to the executive equipment. Due to the incompleteness and uncertainty of the data, it seems rational to involve intelligent approaches to predicting dangerous situations and developing solutions to block them. In this paper, we propose a method based on a special model for presenting the experience of analyzing precedents and a model of a fuzzy periodic graph. The precedent of experience is described by a two-component model, which includes the center and the permissible transformations of the center in a given semantic context. The center is a spatiotemporal situation reflecting the connections and relationships between information objects. Acceptable transformations are a set of areas of possible location of objects and connections in the spatial and temporal boundaries of a cyberphysical object. The search for a solution to block the threat is based on a comparison of known and problematic situations. А distinctive feature of the comparison is the transformation of a known situation into an analyzed location. This is realized by evaluating the connectivity and reachability of vertices of a fuzzy graph of objects and relations of a known precedent. Connectivity is interpreted as a necessary condition for the implementation of a threat. Reachability displays vulnerabilities that can trigger a threat. The proposed method can be used both for the classification of abnormal states and for the construction of solutions in the event of incidents. The limits of the practical applicability of the proposed method are discussed. An application example is considered.