Policies are useful, but without enforcement, they are not a successful means of preventing malware invasions and the theft of business information.