It has to be bigger than what the business can accept as "just a cost of doing business" or it isn't actually a deterrent.