Apparatus and method for threat detection in a device

A method for threat detection in a device comprises maintaining a trust state of installed applications at a device, the trust state comprising an application identifier for each application, such as an application ID or app ID, and trust state of the application, wherein trust state of the application comprises at least one of the following states: empty, trusted, untrusted. The method further comprises searching the trust status with an application identifier of the installed application when an application is installed or of the trust status with an application identifier of the application to be installed when the application is to be installed on the device, the installation requested by a user of the device and/or the installation being a first-time installation of the application on the device. If trust status of the application is trusted, skipping scanning of the installed application. If trust status of the application is empty or not trusted, performing a scanning for the application and/or performing a query for the application from the backend and/or cloud service.