Abstract: Methods, systems, and computer readable media for breach and attack simulation. An example method includes detonating malware within a sandbox; analyzing one or more impacts of the malware based on detonating the malware within the sandbox; generating, based on analyzing the one or more impacts of the malware, an executable malware emulation file; executing the executable malware emulation file on an endpoint system featuring an installed endpoint detection and response (EDR)-under-test solution; analyzing the performance of the EDR-under-test in response to executing the executable malware emulation file; and reporting one or more test results based on analyzing the performance of the EDR-under-test.