Abstract Traditional power systems have evolved into cyber‐physical power systems (CPPS) with the integration of information and communication technologies. CPPS can be considered as a typical hierarchical control system that can be divided into two parts: the power grid and the communication network. CPPS will face new vulnerabilities which can have network contingencies and cascading consequences. To address this challenge, a virtual‐physical power flow (VPPF) method is proposed for the vulnerability assessment of CPPS. The proposed method contains dual power flows, one is to simulate a virtual power flow from decision‐making units, and the other is to simulate a physical power flow. In addition, a novel hierarchical control model is proposed that includes four layers of CPPS: the physical layer, the secondary device layer, the regional control layer, and the national control layer. The model is based on IEEE test cases using data and structures provided by MATPOWER. Denial‐of‐service (DoS) and false data injection (FDI) are simulated as two major cyber‐attacks in CPPS. A novel vulnerability index is proposed that consists of system voltage, network latency, and node betweenness as three key indicators. This is a comprehensive and adaptive index because it encompasses both cyber and physical system characteristics and can be applied to several types of cyber‐attacks. The results of the vulnerability assessment are compared in national and regional control structures of CPPS to evaluate the vulnerability of cyber‐physical nodes.