A system and method for determining physical locations associated with activities detected on mobile devices is disclosed. The method includes accessing at least one enterprise rule set which is based on a plurality of security vulnerability events, and for monitoring at least one application used on the mobile devices. Device data indicative of one or more actions performed on a mobile device and a time associated with each action is used to detect whether actions performed on the mobile device breach a rule of the enterprise rule set. Geolocation information associated with the mobile device at the time associated with the breach is received based on an identifier associated with the mobile device or with wireless network access points in range of the mobile device. The received geolocation information, enterprise rules, and device data is used determine if a security vulnerability is associated with the mobile device.