well if they don't manage it via some kind of MDM software, that would mean the employee is responsible for security on his own - at which point he might as well use his private laptop for work stuff.