Towards Cyber-Physical Vetting of Critical Infrastructures