How Much Security Is Enough?

Companies with less sophisticated or less responsive security would have been in much worse shape, according to Ullrich. But no one can prevent a bot attack completely. "You just do what you can to defend yourself," he says. "If you're hardened from the beginning, maybe they'll go on to someone else."

But no matter how many security people a company hires and how secure its own network might be, no organization is sophisticated enough to remain unscathed in the face of a denial-of-service attack from tech-savvy extortionists, Lindner says. "At the end of the day, the problem is compromised computers," he explains. "If they control those, they can send 10 times as much traffic as you have the capacity for. No matter how many security pros you hire, you still lose."