Companies do not evaluate the effectiveness of their security policies.