She said that her central security group had recognized that policies , no matter how detailed , could never address every scenario that might lead to a security incident .
Policies are inadequate for providing blanket coverage of all scenarios .