1. A computer-implemented method comprising: monitoring, by a computing device, read requests for data, wherein the read requests are sent from legitimate and illegitimate applications, wherein an application is associated with a security rating related to an attribute of the application, and wherein an illegitimate application has a security rating above a threshold; detecting a read request for particular data; determining whether the particular data is important; intercepting the read request for the particular data when the particular data is determined to be important, wherein the read request for the particular data is intercepted before the particular data is retrieved; identifying an application that sent the read request for the particular data; determining the application that sent the read request is illegitimate when a security rating associated with the application is above a threshold; revising the read request for the particular data into a read request for alternative data when the application is determined to be illegitimate, wherein revising the read request for the particular data causes the alternative data to be retrieved rather than the particular data; and sending the read request for the alternative data, wherein when the read request for the alternative data is received, the alternative data is retrieved.