This goes back to the level of protection you need/want, from whom, and whether you're a target of opportunity or a specific target.

Are you protecting against "drive-bys", the casually curious, motivated low-resource targeted attacks (e.g. disgruntled former employees, hated neighbors), "small" resource targeted attacks (<$50k?), high-resource attacks or state entities?