The Yemen-based al-Qaeda offshoot that attempted to ship two cargo bombs to the United States in late October plans more attacks.

“To bring down the U.S. we do not need to strike big,” the group—al-Qaeda in the Arabian Peninsula (AQAP)—said in a new English-language magazine. “It is more feasible to stage smaller attacks that involve less players and less time to launch.”

As for the failed cargo bombs, the group said the two bombs cost about $4,200 in materials and “took a team of less than six ‘brothers’ three months to plan and execute” from beginning to end. If successful, the $4,200 operation could have cost the United States billions, they said.

While America’s vast homeland security apparatus tries to figure out how to prevent future cargo bomb attacks, Americans need to reflect on the reality that we can’t always be lucky. As an Irish Republican Army spokesman said after a failed attempt to kill British Prime Minister Margaret Thatcher in 1984, “ . . . remember we only have to be lucky once. You will have to be lucky always.”

First and foremost, Americans need to realize that building an absolute and perfect defense against terrorism is a Quixotic quest. There are just too many potential targets and too many different ways they can be attacked to successfully defend every target against every attack. Trying to do so would be a recipe for endless spending on more—and more intrusive and expensive, given our penchant to view technology as a silver bullet—security. Intrusive pat-downs and body scans could be just the beginning.

Moreover, much of that spending would be wasted because the very nature of terrorism is to find a weakness and exploit it. That’s exactly what the 9/11 hijackers did—knowing that airport security was designed to screen passengers for firearms, their weapons of choice were knives and box cutters. They also knew that a hijacking would be treated as taking hostages for ransom, not to use airplanes as guided missiles.

And our adversary adapts. As we build defenses, rather than trying to find ways to go through them they find ways around them. The failed shoe bomber, Richard Reid, shows how the terrorists adapted to the increased security measures intended to thwart hijackings. The Christmas Day underwear bomber, Umar Farouk Abdulmutallab, showed how they adapted to the requirement that we take our shoes off to go through airport security. As these examples show, a lot of our security efforts tend to be focused on preventing the last attack rather than the next one. And even if we try to anticipate what the terrorists will do next, we can’t always guess right.

That doesn’t mean we should just give up and make no effort at all to defend against and prevent terrorism. But knowing that we can’t always be lucky means that we also have to deal with the root causes of why people would become terrorists.

The one cause we still refuse to confront is an interventionist U.S. foreign policy that spans both Republican and Democratic administrations—and goes beyond military operations in Iraq and Afghanistan (although those are certainly the most prominent examples). Unnecessary U.S. intervention in the Muslim world, including support for authoritarian and oppressive regimes, fuels the anti-American hatred that sparks terrorism.

To be sure, changing U.S. foreign policy won’t convert those who already hate us into our friends, but it will give the one billion Muslims in the world one less reason to join the ranks of the jihadists and allow us to focus our efforts on those whose minds can’t be changed and are most determined to do us harm.

The harsh reality is simple: If we don’t change our policy, we will most certainly run out of luck.