1. A server device for use in detecting tampering on a client device over a network, comprising: a storage repository that is configured to remotely store tamper event objects for a plurality of client devices; and a hardware processor that is configured to perform actions, including: providing at least one publisher code component to each of the plurality of client devices, wherein the at least one publisher code component is configured to monitor for an unauthorized action on a corresponding client device, and if the unauthorized action is detected, enabling the at least one publisher code component to publish a tamper event object to the storage repository, wherein the tamper event object stores an indication of tampering for the corresponding client device; providing at least one subscriber code component to each of the plurality of client devices while providing at least a portion of media content to one or more of the client devices, wherein the at least one subscriber code component executing on each client device is operative to register to consume a plurality of tamper event objects and to apply specific business rules to each consumed tamper event object and is configured to subscribe to the storage repository, receive tamper event objects from the storage repository that are published by the at least one publisher code component on each of the plurality of client devices, and based on the received tamper event objects, and at least one business rule, to perform at least one defensive action to inhibit the unauthorized action for each of the plurality of client devices; enabling at least one of the subscriber code components and at least one of the publisher code components to initiate registration with each other, wherein each subscriber code component is operable to receive tamper event objects from each respectively registered publisher code component; enabling each publisher code component to publish tamper event objects to at least one of the other publisher code components; and enabling another publisher code component to subscribe to the storage facility and receive the published tamper event objects, wherein the published tamper event objects are employed by the other publisher code component to detect a presence of the unauthorized action associated with the published tamper event object on another client device.