NERC struggles to involve utility vendors in its biennial cyberattack simulation, and that's a big problem, analysts say