How do you validate a safety model when full-scale tests are impossible?

I work on risk models for systems where a full-scale failure test is either too dangerous or too expensive to run.

Reviewers often ask for experimental validation anyway, and I'm never sure how much partial data or expert judgement is enough.

How do you make the case that a model is validated when the real test can't be done?