1. A method of confirming an application change event associated with a device infrastructure of a mobile device, the method comprising: identifying an application change event processed by the device infrastructure, the application change event comprising a change specific to an application of the mobile device; in response to identifying the application change event, disabling the application associated with the application change event; sending an application authorization request from the mobile device over a communications network, the application authorization request including application identification information which identifies the application associated with the application change event; receiving a decision instruction at the mobile device, the decision instruction being based on a comparison of the application identification information with one or more listed applications in a plurality of applications identified in an application authorization list, the application authorization list being remote from the mobile device over the communications network, the application authorization list comprising a combination of application lists collected from a plurality of mobile devices including the mobile device, each of the application lists comprising identification of applications installed on a respective one of the plurality of mobile devices; and performing an action on the mobile device in respect of the application associated with the application change event, based on the decision instruction.