This simulation quantifies supply-chain risk the way enterprise risk teams actually do it: with Monte Carlo simulation, not intuition. Four independent disruption sources — supplier failure, port closure, severe weather, and cyberattack — each fire as their own Poisson process with its own frequency and impact distribution. Mitigation investment reduces how often events occur; inventory buffer reduces how badly the supply-sensitive events hurt when they do (cyberattack is deliberately immune to a buffer). Every simulated year's losses accumulate on a live central column and, once complete, feed a running histogram used to compute two portfolio risk metrics in real time: Expected Annual Loss and 95%-confidence Value at Risk. Toggling individual risk sources off demonstrates portfolio diversification directly — concentrating exposure in fewer, larger sources raises both metrics even when total event frequency is unchanged.