1. A method comprising: collecting autonomously, by a service provider processor of a service provider, information associated with an enabled feature set of an application specific to a remote client device, and information associated with the client device, wherein the client device runs the application to conduct one or more transactions with the service provider, and wherein the information associated with the client device comprises a location; detecting, by the service provider processor, at least one suspicious activity indicative of an attempt to breach data security or system integrity of the service provider using the collected information; determining, by the service provider processor, a risk assessment for the remote client device from the at least one suspicious activity; determining from the collected information, by the service provider processor, one or more features of the enabled feature set of the application to disable on the client device using a predefined set of rules comprising a position based feature set specific to the location that determine the features of the application to disable from the collected information and types of the one or more transactions conducted by the client device if the transactions are considered, and otherwise determines the features of the application to disable from the collected information independent of the one or more transactions conducted by the client device with the service provider; disabling remotely, by the service provider processor, the features of the application on the client device without affecting a second client device that runs the application by at least requiring additional authentication to utilize the features; and disabling remotely, by the service provider processor, the application entirely if the risk assessment meets a severity threshold.