In recent years, we have seen a number of successful cyber-attacks against high-profile targets, which have demonstrated that resourceful and determined attackers can penetrate even highly secure systems. In light of these attacks, it becomes apparent that defenders of cyber-physical systems cannot focus solely on preventing attackers from penetrating their systems. Instead, they must also prepare to promptly detect and mitigate security breaches, thereby limiting the impact of successful attacks.