1. A method of analyzing a security specification, the method comprising: identifying a downgrader in a computer program under test; via a processor, performing testing on the downgrader in a first level of analysis; responsive to the downgrader not passing the testing performed in the first level of analysis: automatically synthesizing a counter example for the downgrader; creating a test unit for the downgrader using the counter example as an input parameter to the downgrader; executing the test unit to perform testing on the downgrader in a second level of analysis; and responsive to the downgrader passing the testing performed in the second level of analysis, prompting a user to simplify a model of the downgrader.