It's been clear for years that CRE firms are frequently targets of cybercriminals. There's no way to avoid the possibility of being targeted, so each company needs to protect itself.

But what does self-protection really mean? How much will it cost? How many experts are needed? When does it stop?

One reason for all the questions, as Arizona State Associate Research Professor Christos Makridis, University of Arizona Associate Professor Anne Boustead, and Indiana University Provost Professor Scott Shackelford addressed in a recent Brookings Institution research report, is the difficulty of knowing what the impact of an attack is. "Estimates vary markedly in part because most studies either take a survey-based approach where respondents are asked the cost of a data breach—which produces highly variable and often questionable numbers—or a stock market-based approach where returns are compared before and after a data breach—which also delivers unreliable estimates since the market often does not know how to react," they wrote.