Deploying security countermeasures on Cyber-Physical Systems (CPS) can induce side-effects that can exceed their benefits. When CPS are safety-critical systems, performing efficiency and impact assessments of security countermeasures early in the design flow is essential. The paper introduces the W-Sec method, based on SysML-Sec. The W-Sec method consists in two interwoven formal modeling and verification cycles aiming at providing countermeasures with objective and quantitative efficiency and impact assessments in terms of safety, security and performance. The paper evaluates the W-Sec method with an autonomous rover swarm case-study, and finally discusses the method's strengths and weaknesses highlighted by the case-study results.