In the aftermath of 9/11 and the run-up to the Iraq war, the Bush administration raised the specter of terrorists using weapons of mass destruction (WMDs). Indeed, then-National Security Advisor Condoleezza Rice made the case for toppling Saddam Hussein’s regime by ominously stating, “We don’t want the smoking gun to be a mushroom cloud.” And the Obama administration’s national security strategy states “there is no greater threat to the American people than weapons of mass destruction, particularly the danger posed by the pursuit of nuclear weapons by violent extremists.” Yet, the bombing at the finish line of the Boston Marathon is a tragic reminder that the more likely terrorist threat has been (and will continue to be) old-fashioned explosives—otherwise known as improvised explosive devices or IEDs.

That IEDs would be used by terrorists, foreign or domestic, should come as no surprise. After all, IEDs (homemade bombs in backpacks) were used in both the 2005 Madrid train bombings and the 2005 London Underground bombings. And Timothy McVeigh used an IED (a rental truck with some 5,000 pounds of ammonium nitrate fertilizer and fuel oil) to destroy the Alfred P. Murrah Federal Building in Oklahoma City in 1995, killing 168 people and injuring more than 680 others.

And unlike WMDs, IEDs are relatively cheap and easy. McVeigh’s truck bomb is estimated to have cost him $5,000 for the truck and all the materials. Backpack IEDs probably cost a few hundred dollars, if that. None of the component parts needed to build an IED are illegal (the Boston backpack bombs are believed to have been built using pressure cookers as the containers, black powder or gunpowder as the explosive charges, and nails, BBs, and ball bearings as shrapnel). And the know-how to build IEDs is pervasive. Ironically, U.S. military operations in Iraq and Afghanistan have indirectly served as incubators for both bomb-makers and bombers to hone their craft and spread their knowledge (pressure cooker IEDs have been used by the Taliban in Afghanistan).

So what should we do now that threat has come to roost at home?

The Department of Defense—largely through the Joint Improvised Explosive Device Defeat Organization (JIEDDO)—has spent billions of dollars combating IEDs in Iraq and Afghanistan. Naturally, one would suppose that expenditure should be leveraged as much as possible to transfer capabilities (equipment and training) and lessons learned to domestic counter-IED (C-IED) efforts. It can and should be, but there are limitations on how much can be transferred—what the U.S. military is able to do in a foreign country is very different from the standards demanded of our domestic police and security in the United States.

The White House recently released a Countering Improvised Explosive Devices statement that empowered the Joint Program Office (JPO) for Countering IEDs (an interagency group administered by the FBI) to coordinate federal government counter-IED activities. But the JPO is not an organization empowered with budget authority—it will be up to individual departments, such as the Department of Homeland Security (DHS), to decide how much to spend on developing and deploying counter-IED capabilities.

Ultimately—no matter how much money and effort is put forth toward C-IED—we have to be realistic about our expectations. The federal government (as well as state and local law enforcement) will never be able to uncover every plot to prevent every attack. Neither can they protect every possible target, nor can their preemptive operations trespass against our constitutional rights to privacy. So prevention and protection efforts need to be balanced against response, recovery, and mitigation efforts. Put another way, we need to be resilient in the face of tragedy and be able to bounce back—just as Boston is now doing.

Perhaps most importantly, we have to learn to live with the reality that a determined terrorist—whatever their motivation—will eventually be able to succeed, no matter how much security we put in place. As the Irish Republican Army said after a failed attempt on then-Prime Minister Margaret Thatcher’s life in 1984: “Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always.” Thus, we can either sacrifice individual liberty for the strong arms of the state, which can only provide the illusion of security; give up our way of life by cancelling all civic events like marathons and ballgames where thousands of “targets” gather; or be willing to accept the risk of sometimes being unlucky and that another Boston could happen.