Methods and systems are provided for monitoring cyber activity in a system having multiple networks. A method includes: receiving an evidence stream generated by a plurality of monitoring systems associated with a plurality of hardware and software components that communicate over the multiple networks; processing the evidence stream using at least one reference model to identify at least one cyber issue, where the cyber issue relates to at least one of security, safety, and resources; and generating at least one of actuator data and user interface data based on the identified cyber issue.