“Windows protected your PC” is not a virus warning. It is Microsoft Defender SmartScreen saying it has not seen this file, or this publisher, often enough to have an opinion. Understanding that one sentence saves a great deal of wasted money.
What SmartScreen actually checks
SmartScreen scores a download on the reputation of the file hash and the reputation of the signing identity. An unsigned file starts from nothing and never accumulates publisher reputation, because there is no publisher to attribute it to. A signed file contributes to a reputation score that carries across your future releases — which is the real reason to sign.
Why a new certificate does not help immediately
Buying a certificate today does not buy reputation. On day one your signed installer still trips the warning, because the signing identity is new. What changes is that every download from that point forward now counts toward something.
Until 2024, EV code signing certificates were an exception: they granted immediate SmartScreen reputation. Microsoft removed that behaviour. Any page still selling EV on the promise of an instant SmartScreen fix is out of date. EV is still mandatory for kernel-mode driver submissions through the Windows Hardware Developer Program — that is now the honest reason to buy it.
What actually shortens the warning period
- Sign every release with the same identity. Reputation is cumulative. Signing only your “big” releases throws away most of the signal.
- Timestamp every signature. Without a timestamp your signature expires with the certificate and old installers start failing verification.
- Keep the file hash stable where you can. Rebuilding the installer for every download attempt scatters reputation across hashes that each start from zero.
- Distribute from one canonical URL. Mirrors and re-zipped copies do not inherit your file reputation.
- Sign the inner binaries, not only the installer. An extracted, unsigned
.exetrips the warning again after the installer passed.
What does not work
- Submitting the file to Microsoft as a false positive. That queue is for misclassification, not for missing reputation.
- Buying an EV certificate expecting a same-day fix (see above).
- Asking users to click “More info → Run anyway”. They mostly do not.
Where a certificate does pay off immediately
The dialog itself changes. An unsigned file shows “Unknown publisher”. A signed file shows your verified company name. For B2B software that difference alone is often worth the certificate, before reputation even enters the conversation.
Ready to sign? Standard code signing covers user-mode applications; EV is the one to buy if drivers are on your roadmap.