1. A server for use in detecting tampering on a client device over a network, comprising: a repository that is configured to store tamper event objects; a processor that is configured to perform actions, including: providing at least one publisher component to the client device, wherein the at least one publisher component is configured to monitor for an unauthorized action on the client device, and if the unauthorized action is detected, to publish a tamper event object to the repository; and providing at least one subscriber component to the client device, wherein at least one subscriber component is configured to subscribe to the repository, receive published tamper event objects, and based on the tamper event objects, and at least one business rule, to perform at least one defensive action.