When does Targeting make sense for an attacker?

How do so many Internet users escape harm? The range of attacks is enormous and growing; we know that most users neglect even very basic defense measures. Yet things somehow muddle along: two billion people use the Internet and seem to derive more good from it than harm. If security is only as good as the weakest link why don’t worst-case outcomes happen regularly? Why isn’t everyone hacked every day? The answer may lie in economics rather than technology.