How far should organizations be able to go to defend against cyberattacks?