1. A cyber defense method for protecting an enterprise system having a plurality of networked components, comprising: collecting connectivity and relationship information indicative of connectivity and behavior of the components; creating a relationship graph based upon the connectivity data and the relationship data, wherein nodes of the relationship graph represent the components and edges of the graph represent connectivity and relationships; storing at least part of the relationship graph to form a chronology; analyzing the relationship graph and the chronology to predict connectivity and relationship changes within the enterprise system; and identifying a first anomaly when the current connectivity and relationships do not match the prediction.