1. A system for off-device anti-malware protection for mobile devices, comprising: a processor configured to: receive a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; determine whether one or more of the plurality of applications identified in the software inventory are associated with malware based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises to: perform the following: determine whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job; in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determine that the one or more of the plurality of applications are associated with malware; determine whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services; and in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determine that the one or more of the plurality of applications are associated with malware; and send results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy; and a memory coupled to the processor and configured to provide the processor with instructions.