Workphones should be locked so that nothing can be installed unless IT white-lists it, IMHO. Otherwise, either IT does not know what's on their devices at all.

Workphones should be locked so that nothing can be installed unless IT white-lists it, IMHO. Otherwise, either IT does not know what's on their devices at all. Or they need to install scanning software to keep track and sonehow take action as needed. So best to go at the source and start by preventing users from installing anything.