Despite the evolution of cyberattacks from obscure threat to everyday occurrence, many multinational companies still fail to recognize or adequately gauge the potentially damaging impact of a security breach.

Compliance Week points to several reasons for this persistent blind eye. For one, too many business leaders consider cyber-security issues as an IT problem (a perspective shared by IT). This can lead to a senior leadership that’s left uninformed as of breaches even as IT pours all its resources into sealing them.

There’s also a great disparity in the perception of cybersecurity risks by companies, varying by industry sector and actual physical location. (The percentage of respondents in the United States who view cyber-crime as posing a high risk comes in at 70%. That figure is a mere 30% for respondents from countries like Canada, Singapore and the Netherlands.)

Perceptions aside, the fruits of cyber-crime are themselves big business. “There is an entire underworld of selling stolen information,” says Brian Finch, a partner in Pillsbury’s Washington, DC office. “It’s a pretty sophisticated black market.” Especially when it comes to intellectual property, the fact that there are “independent groups that are operating with the blind eye of the host government” should be a great concern, according to Finch.

“The availability of malware and cyber-criminals for hire is enormous, and the likelihood of being caught, much less suffering any sort of punishment, is minimal,” Finch says. “We’re always going to be subject to attacks.”

Finch goes on to point out that even the best cyber-defense requires more maintenance than traditional forms of security. “Companies need to realize that they have to constantly revisit their cyber-defenses,” Finch says. After all, few would-be cyber-criminals have much reason to take “no” for an answer.