SmartScreen file submissions remain "In progress" for 13+ days after EV certificate renewal — what is the expected review SLA?

Question Summary

After renewing our EV Code Signing certificate (GlobalSign GCC R45 EV CodeSigning CA 2020, issued April 2026), all binaries signed with the new certificate trigger SmartScreen warnings on first download, even though they validate correctly and show 0/69 detections on VirusTotal.

We understand the August 2024 Trusted Root Program update removed the automatic SmartScreen reputation grant for EV certificates, and that reputation must now build organically. We are following the documented remediation path, but the process appears to have stalled.

(Current date: April 28, 2026.)

What We Have Done

File submissions

We submitted signed installer variants to https://www.microsoft.com/wdsi/filesubmission in two batches (April 15 and April 24, 2026). As of April 28, all submissions still show "In progress" in the submission history portal — 13+ days after the first batch.

Microsoft Defender Response correspondence

• April 25 — Microsoft Defender Response replied to one of our earlier submissions, confirming the file is clean, the signature is valid, and the certificate "is currently in the process of establishing reputation."
• April 27 — We sent a follow-up email asking for guidance.
• April 28 — No response yet.

Independent verification

• VirusTotal: 0 / 69 detections on the submitted installer (see attached image)
• All files properly timestamped
• Certificate chain validates correctly

Specific Technical Questions

1. What is the expected review timeline (SLA) for files submitted via the Defender file submission portal?
   The portal does not publish an SLA, and "13+ days, still In progress" with no further communication is difficult to plan around.
2. Does SmartScreen reputation propagate across multiple binaries signed by the same certificate (same thumbprint), or is reputation purely per-file-hash?
   Documentation suggests certificate-level reputation exists, but in practice we only observe per-file behavior.
3. Is there any documented or recommended way for a publisher to verify whether their signing certificate has accumulated meaningful reputation, short of empirically downloading from many machines?

Certificate Details

Reference Submission

The submission Defender Response replied to (April 25): b24a447c-1726-4aec-954d-288850c312c0

Additional submission IDs from both batches are available on request.

VirusTotal Results.png

Any technical guidance on the review process, reputation propagation behavior, or recommended verification methods would be appreciated. Thank you.