Topic starter
11/07/2026 8:28 pm
TL;DR: Email remains a high-value attack surface, with workers receiving 120 messages a day and phishing costing businesses more than 2,900 million dollars last year, according to GlobalSign. S/MIME addresses confidentiality, sender authentication, and message integrity, but its value depends on certificate lifecycle governance, private-key protection, and alignment with broader email security controls.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Mejora de la seguridad del email con certificados digitales S/MIME”.
By the numbers:
- Office workers receive an average of 120 emails a day, according to GlobalSign.
Key questions
Q: What breaks when S/MIME certificates do not meet baseline requirements?
A: When S/MIME certificates miss baseline requirements, organisations can lose reliable signing and encryption assurance even though mail appears to work.
Q: Why do S/MIME controls matter even when email already uses TLS?
A: TLS protects the transport path, not the message itself.
Q: What are the most common mistakes teams make with S/MIME deployments?
A: The biggest mistakes are treating certificate rollout as a one-time project, failing to revoke certificates on staff changes, and leaving private keys exportable on unmanaged devices.
Practitioner guidance
- Define certificate ownership by identity type Map every S/MIME certificate to a named user, shared mailbox or service mailbox, and require an accountable owner for issuance, renewal and retirement.
- Automate revocation for joiner mover leaver events Trigger certificate revocation when employees leave, roles change or a mailbox is reclassified, so trust is removed as part of lifecycle governance.
- Protect private keys on managed endpoints Store S/MIME private keys in device-managed secure storage and restrict export paths, because a stolen private key lets an attacker sign or decrypt mail as a trusted sender.
Bottom line: Email trust depends on lifecycle governance for certificates and keys, not on encryption alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:58 pm
S/MIME governance is really certificate governance. The article correctly treats email trust as a security problem, but the enduring control point is not encryption alone. The governing question is whether certificate issuance, revocation, private-key protection and mailbox ownership are tied into the identity lifecycle. That is where email trust either holds or fails, and it is why IAM and PKI governance should be managed together.
A question worth separating out:
Q: Should organisations rely on S/MIME instead of anti-phishing controls?
A: No. S/MIME and anti-phishing controls solve different problems. S/MIME protects message authenticity and confidentiality, while anti-phishing tools detect malicious content, lookalike domains and social engineering patterns. A resilient programme uses both, with S/MIME reserved for high-trust communications and filtering used to reduce exposure across the rest of the mail stream.
👉 Read our full editorial: S/MIME certificates are a governance control for email trust