Issue 7 | October 2026
This month: Leo Grove, SSL President and CEO, introduces the DIgital Trust Platform (DTP), AI-powered trust infrastructure.
Plus: If a hacker group can embarrass the FBI, what could it do to your organization?
From the Desk of Leo Grove, SSL President and CEO
Twenty-five years ago we started our journey by reselling and then issuing certificates. Today we’re launching the platform that issues itself. From the team that built SSL, a publicly trusted CA operating at global scale, I’m thrilled to introduce the Digital Trust Platform (DTP) at app.digitaltrust.io.
DTP is AI-powered trust infrastructure. Not another console with 40 tabs and a 200-page admin guide. It’s infrastructure you simply ask for. A private PKI hierarchy used to be a two-quarter project with a consultant attached. In DTP it’s an afternoon.
Here’s what that actually means:
“We need a post-quantum migration plan.” No PQC experience on your team? Ask the Assistant. It builds your transition roadmap; crypto inventory, algorithm selection, phased rollout, and then implements it.
“47-day TLS certificates are coming. We’re not ready.” Ask the Assistant. Automated lifecycle management, issuance, renewal, revocation. The shrinking validity window stops being a fire drill and becomes a non-event.
“Legal wants C2PA content credentials on everything we publish.” Ask the Assistant. Claim signing, timestamping, provenance; configured and running.
DTP integrates with the major cloud platforms, so orchestration and migration are configuration, not a rebuild. It’s also CA-agnostic; public or private, ours or someone else’s, DTP manages all of it from one place. You should not have to re-platform your trust to modernize it.
This is the part that changes the job. DTP is more than just execution, it’s a subject matter expert on call.
CISOs, infrastructure leads, platform teams: stop managing PKI. Start asking for it.
Early access is open. You can see screenshots here on my full LinkedIn post. If you’d like to learn how to get started, DM me on LinkedIn and my team will get back to you.
Recent News: The Latest from the Digital Trust Landscape
Cloudflare moves to become a public certificate authority – Cloudflare announced plans to launch its own public CA, issuing traditional TLS certificates alongside next-generation post-quantum Merkle Tree Certificates. With applications already filed to join the major browser root programs, the move could reshape who issues the certificates that secure the web as the industry races to prepare for quantum threats. Full story
Hackers deface the FBI’s jobs site and claim data on nearly every agent – The ShinyHunters extortion group, the same crew linked to breaches at Instructure, Salesforce, Snowflake, and McKesson, says it stole sensitive data on FBI agents and job applicants. The FBI confirmed it is investigating. Full story
Interpol dismantles West African cybercrime networks in global crackdown – A coordinated law enforcement operation spanning 22 countries led to 58 arrests and 263 identified suspects tied to organized crime groups behind business email scams, romance fraud, and money laundering. The operation, the fourth in an ongoing series, shows international cooperation making real headway against the crime-as-a-service networks fueling much of today’s cyber-enabled fraud. Full story
Industry Spotlight: Practical Solutions for Real-World Challenges
When a Trusted Inbox Becomes the Attack Vessel
On September 30, 2026, approximately 9,000 phishing emails went out to journalists’ sources, interviewees, and business contacts worldwide. They came from a real Nikkei employee account. The sender address was legitimate. The name was familiar. There was nothing in the metadata to suggest anything was wrong. The emails contained links to malicious websites, and the recipients, many of them journalists’ confidential sources, had every reason to click.
Nikkei, the Japanese publishing giant behind the Financial Times and the Nikkei Asia business press, disclosed the incident on October 4-5, 2026. Attackers had compromised employee accounts at both Microsoft 365 and Google Workspace, with the Google Workspace breach traced back to late July and the Microsoft 365 breach used as the launchpad for the September 30 phishing campaign.
The business impact: For a media organization whose relationships with sources depend entirely on trust and confidentiality, this incident cuts deeper than most. The 9,000 phishing emails went not to random recipients but to people who had previously corresponded with Nikkei journalists, a contact list that, in a newsroom context, includes whistleblowers, executives, officials, and other individuals who assumed their communications were private. Beyond the immediate phishing risk to those recipients, the breach exposed names, email addresses, and the content of some messages. Nikkei has asked affected individuals to delete the emails, a request that, as with the Morgan Stanley incident, cannot be enforced.
What would have prevented it: The attack succeeded because a hijacked account is indistinguishable from a legitimate one. The sender address was real. The account was real. The only thing missing was the one signal that would have told recipients something was wrong. SSL’s S/MIME certificates digitally sign outgoing emails using a private key stored on the sender’s device, not in the cloud account. That distinction is what matters here. An attacker who compromises cloud credentials can send email from the hijacked account, but they cannot produce a valid S/MIME signature without access to the sender’s private key. Recipients using S/MIME-aware email clients would see that the expected digital signature is absent, a visible, cryptographic indication that the message is not what it appears to be, before any link is clicked. The 9,000 phishing emails sent on September 30 would have arrived unsigned. That absence is the warning.
The broader lesson: Credential compromise is not going away, and cloud email accounts are a primary target precisely because they carry so much inherent trust. An attacker with access to a legitimate account has access to everything that account represents: the sender’s reputation, their contact list, and the goodwill built across years of correspondence. S/MIME does not prevent an account from being compromised. What it does is ensure that a compromised account cannot fully impersonate its owner, because the cryptographic proof of identity lives somewhere the attacker cannot reach. For organizations where email trust is a core operational asset, that distinction is the difference between a contained credential incident and a breach that reaches thousands of people who had no reason to doubt what they received.
Past and Upcoming Events: Conferences, Standards Meetings, and more
Did you miss our latest webinar? No worries! You can now watch the replay on demand.
“Protect Your Infrastructure with a Backup CA: A Multi-CA Certificate Strategy” was hosted by Tim Reidel, SSL Director of Product Management, and explored why enterprises need more than one option for their critical infrastructure.
This webinar covers what a second CA absorbs during an outage or a root removal, how splitting issuance keeps peak volume inside rate limits, and running two issuers behind one automation layer. Watch now.
SSL will also be attending this year’s Cloudfest Americas in Miami from November 10-12. The event is part of the CloudFest global event series and serves as the convergence point for the Cloud and internet infrastructure ecosystem across the Americas.
Contact us now to schedule upcoming meetings with our team.
Quick Links: Guides, Articles, and Industry Resources
- How to Create a Document Signing Workflow with eSigner — Learn to streamline signing with eSigner: Create workflows for digital signatures on key documents, ensuring secure and efficient processing.
- How to eSeal a Document using eSigner — Learn how to use eSigner eSeal to apply digital signatures to PDFs and test certificate-based signing before purchasing an Individual or Organization Validation certificate.
- How to Add a Digital Signature to a PDF Document Using eSigner — Learn how to digitally sign documents with eSigner: A secure, browser-based solution for adding trusted signatures and timestamps.
- Getting Started with your eSigner Account — Learn how to set up your eSigner account and configure annotation-based and digital signatures to sign PDF and Microsoft Office files with flexible signing options.
- Removal of the Client Authentication EKU from TLS Server Certificates – What You Need to Know — Learn why the Client Authentication EKU is being removed from TLS server certificates, how it impacts your systems, and what steps to take to stay compliant.
Have questions about any of these topics or want to discuss your digital trust solutions with our experts? Reach out to us below: