Companies often underestimate the danger of online attacks, especially small firms. IBM wants to teach managers what to do in an emergency by simulating an attack.