How should countries defend against committed terrorists who attack until defeated? We identify a fundamental non-convexity--one only needs to defeat the terrorist once. Consequently, provided a country values targets similarly, it should conceal defenses and allocate defense resources randomly.