Business continuity planning should include simulations for zero-day incidents — not just ransomware or known malware