There models of complex information system security risk propagation are proposed in this paper based on cellular automata, and the probabilistic behaviors of security risk propagation in complex information systems are investigated by running the proposed models on nearest-neighbor coupled network, Erdos-Renyi random graph network, Watts-Strogatz small world network and Barabasi-Albert power law network respectively. Analysis and simulations show that the proposed models describe the behaviors of security risk propagation in the above four kinds of networks perfectly. By researching on the propagation threshold of security risks in four kinds of network topology and comparing with the existing research result, the correctness of the models is verified. The relationship between the heterogeneity of degree distribution and the value of the propagation threshold is analyzed and verified in this paper. Through the research on the evolutionary trends of security risk propagation, the relationship between the heterogeneity of degree distribution and the influence sphere and speed of security risk propagation is analyzed and verified as well. Meanwhile, the relationship between the heterogeneity of degree distribution and the effect of the immune mechanism on controlling security risk propagation is pointed out. Furthermore, the result of simulations describes the negative exponent relationship between security risk extinction rate and the propagation rate. The key factors affecting the security risk propagation are analyzed in this paper, providing the guidance for the control of security risk propagation in complex information systems.