Recently, Graphical Security Models (GrSMs) became widely used for security analysis. The basic formalism called Attack Tree (AT) has been augmented with new attributes covering defence, response, and countermeasure aspects to support security modelling and analysis in vulnerable systems. Although the models have strength in visualising and analysing small attack-defence scenarios, these suffer from lack of scalability when increasing nodes and adaptability with other refinement models to show the dynamic nature and state of systems in interest. In this work, Coloured Petri net (CPN) is used to fulfil the mentioned shortcomings in GrSMs (specifically Treebased models). It is applied for evaluating each component´s interactions, the impact of threats as well as defence systems to mitigate those threats. For that end and pointing out the CPN adaptability with GrSMs, a set of mapping rules are proposed allowing translation of ATs extension into CPN and their analysis. The quantitative analysis aspect is addressed in this work by introducing computing transition. We validate our proposed approach by applying it in an example of SCADA systems cybersecurity analysis.