An analysis system includes: a configuration information acquisition unit which acquires configuration information from an agent which collects the configuration information of a device by scanning the device included in a system to be diagnosed; a generation unit which generates one or more initial facts which indicates a situation relating to security in the system to be diagnosed or the device based on the configuration information; and an analysis unit which analyzes a flow of an attack which is executable in the system to be diagnosed based on the one or more initial facts.