Can you store email/attachments/other information outside of the application? If so that application is a massive security risk.

This is crazy talk.

If it's a major security risk, don't sync it to someone's pocket. By syncing it to someone's pocket... it's out. Especially if it's on their personal phone, you can't control what they (or an attacker) will do.

Either that's an acceptable convenience / risk tradeoff, or it's not. If it's not, you need to focus your efforts on tagging confidential data and keeping it inside the "walls" of your organization... but that's not a technology problem, it's a people problem.

syncing to someones pocket is fine if you can remote wipe it

But you can't guarantee that you can wipe it. What if it's not connected to the 3G network? What if the data has already been pulled off? What if it's been copied to a memory card on the phone? What if the phone doesn't properly implement this feature?

If you're using a Blackberry then you encrypt the entire device. The entire memory is encrypted with the device password and a wipe is triggered from too many incorrect passwords.

I don't know if the Exchange devices do the same thing - our company requires this kind of security, so we still only allow Blackberry.