How can a small software publisher build SmartScreen reputation?

Question

We are a legitimate German software company (Dr. Dresing & Pehl GmbH) publishing qualitative data analysis software since many years.

After renewing our OV code signing certificate (Sectigo, valid until 2028), our installers show the "Windows protected your PC" warning. This has persisted for over 4 months despite clean antivirus results (0 detections).

Our previous certificate had full reputation. The new certificate uses a new key from the same CA.

We submitted our installer via the Security Intelligence portal on April 7, 2026, but the status remains "Pending".

As a small publisher with limited download volume, how can we establish reputation? Is there a way to contact the SmartScreen team directly?

Thank you.

Answer 1

SmartScreen and other Microsoft reputation systems don’t provide a direct “build reputation” or whitelist channel for small publishers, and there’s no separate SmartScreen contact path beyond the existing submission workflows.

Key points from Microsoft’s guidance that apply to this scenario:

1. No manual “known list” or false‑positive prevention program
   • Microsoft explicitly does not accept files for a “known list” or false‑positive prevention program from software developers. Reputation is built automatically based on telemetry and analysis, not by manual enrollment.
   • Consistently signing program files with a digital certificate issued by a trusted root authority helps Microsoft quickly identify the source of a program and apply previously gained knowledge. Over time, this can result in the program being added to a known‑good list or, less frequently, the publisher certificate being treated as trusted.
2. How to handle potential false positives / reputation issues
   • For any installer or binary that is being flagged or blocked, the supported path is to submit the file as a software developer and wait for a final determination.
   • If the determination is unsatisfactory, the developer contact form that appears with the submission result is the only supported way to reach Microsoft for further review.
   • Microsoft encourages software vendors to review the documented criteria used to classify malware and potentially unwanted applications (PUA) to ensure installers and bundled components do not match unwanted behaviors.
3. Reputation and “uncommon” warnings
   • Microsoft’s reputation systems explicitly warn about software that is unknown or uncommonly downloaded. This is by design: unknown software is treated as higher risk until enough telemetry and analysis data is collected.
   • Warnings for unknown or uncommonly downloaded software are not hard blocks; users can still choose to run the application. Over time, as more users download and run the software without issues and as Microsoft’s systems analyze the binaries, reputation can improve automatically.
4. Practical implications for a small publisher Based on the above, the supported ways to build and maintain reputation are:
   • Continue to sign all binaries and installers consistently with the same OV certificate from a trusted CA.
   • Avoid bundling or behaviors that could match Microsoft’s PUA or unwanted‑software criteria.
   • Submit new or updated installers through the official submission portal whenever they are first released or when reputation problems are observed, and then use the developer contact form if the final determination is incorrect.
   • Accept that reputation for a new certificate (new key) is built over time from usage and analysis; there is no separate SmartScreen team contact or manual reputation “transfer” mechanism exposed in the documentation.

There is no documented mechanism to directly accelerate SmartScreen reputation for a new OV certificate beyond these steps.

---

References:

• Software developer FAQ
• How Microsoft identifies malware and potentially unwanted applications