Here's an idea: allow creating exceptions for applications signed by a "trusted" publishers.

We often come across a situation, when our internally developed software or software that comes from our vendors triggers false positives in SEP12.