Despite advancements in their performance, cyberphysical systems such as railways remain susceptible to cyberattacks. The focus is on the turnout system in railway transportation infrastructure. For such systems, the data monitored is geographically dispersed, which make them vulnerable: attackers may either conceal failures or trigger unnecessary maintenance decisions. To address this issue, a threat assessment paradigm is proposed in order to provide maintenance operators with a threat indicator based on field data.