Estimate credential exposure during a breach based on password strength, reuse behavior, MFA coverage, and attacker capability. This is a heuristic model for risk awareness.