Performing a security action in response to a determination that a computing device is lost or stolen

In response to a computing device of a user being reported as lost or stolen, various steps associated with security for the computing device are performed. In one approach, a database is marked to indicate that the computing device is lost or stolen. Applications that are installed on the lost or stolen computing device are determined, and a security action is selected based on this determination. In some cases, the selected security action reduces or denies service to the computing device, and/or blackholes traffic to or from the installed application. A service provider associated with the installed application is determined, and a notification is sent to the service provider. The notification indicates the installed application, and that the computing device of the user has been lost or stolen.