Simulating breach scenarios and calculating business impact requires continuous Breach-and-Attack Simulation (BAS), threat modelling, and translating results into cyber risk metrics via board-level dashboards.