We study a security game in which an attacker seeks to disable sensors in a cyber-physical system by simultaneously compromising both their cyber access points and physical components. The defender can respond by deploying honeypots in the cyber domain and protecting a subset of sensors in the physical domain. We model this interaction as a non-zero sum, simultaneous-move game and propose a solution approach based on the double oracle framework. To address the combinatorial action space of the defender, we develop a greedy oracle and prove that it provides a constant-factor approximation using submodularity. Although the game is not zero-sum, we show it can be transformed into a strategically equivalent zero-sum game, enabling efficient equilibrium computation for restricted games. We also analyze a special case where the cyber network reduces to a star topology and derive the structure of the Nash equilibrium under certain conditions. Finally, simulation results show that our greedy oracle achieves near-optimal performance, on average within \(5.21\%\) of the optimal, while scaling effectively to large problem sizes.