{"id":803530,"date":"2026-08-05T13:22:11","date_gmt":"2026-08-05T13:22:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/803530\/"},"modified":"2026-08-05T13:22:11","modified_gmt":"2026-08-05T13:22:11","slug":"microsoft-forks-out-record-breaking-sums-with-expanded-bug-bounty-program","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/803530\/","title":{"rendered":"Microsoft forks out record-breaking sums with expanded bug bounty program"},"content":{"rendered":"

Microsoft has dished out its biggest collection of bug bounties<\/a> ever over the last year, awarding more than $20 million to 562 security researchers.<\/p>\n

Microsoft Security Response Center (MSRC) said the figure was well up on the $17 million distributed the year before to 344 researchers from 59 countries \u2013 itself a Microsoft Bounty Program record.<\/p>\n

<\/p>\n

Part of the reason for the increase is the company’s new ‘In Scope By Default<\/a>‘ policy.<\/p>\n

Last year, it expanded its vulnerability awards portfolio to recognize ‘impactful’ research that fell outside the scope of traditional bounty programs, including eligible open source software, third-party components, and Microsoft cloud services.<\/p>\n

Since then, the tech giant said it’s received more than 300 additional reports and awarded more than $800,000 for vulnerabilities that wouldn’t previously have qualified for bounty awards.<\/p>\n

The firm noted it also saw a notable increase in submission volume during the second half of the year.<\/p>\n

“Security is a team sport. Every vulnerability reported through our bounty programs represents an opportunity to address risk before it can be exploited against customers,” said the MSRC team.<\/p>\n

Sign up today and you will receive a free copy of our Future Focus 2026 report – the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.<\/p>\n

“The work of the research community plays a critical role in helping Microsoft stay ahead of emerging threats while strengthening the security of cloud services, AI systems, enterprise platforms, and consumer technologies.”<\/p>\n

Microsoft Zero Day Quest<\/p>\n

The figures include findings from this year’s Microsoft Zero Day Quest, which saw security researchers from 20 countries meeting at Microsoft\u2019s Redmond campus to collaborate directly with security and engineering teams.<\/p>\n

This research challenge and live hacking event was focused on high-priority security scenarios across Microsoft\u2019s cloud and AI platforms. That saw nearly 700 vulnerability reports submitted, with researchers collecting $2.3 million in awards.<\/p>\n

Individual awards depend on the type of vulnerability reported, with cloud programs and Zero Day Quest vulnerabilities capped at $100,000 per vulnerability. Endpoint and on-premises program vulnerabilities, meanwhile, can earn bug-hunters up to $250,000.<\/p>\n

“This year\u2019s record-breaking results, including more than $20 million in awards and recognition for 562 researchers, reflect the impact of a strong partnership between Microsoft and the global security research community,” said the team.<\/p>\n

“Whether participating through a traditional bounty submission, collaborating through coordinated vulnerability disclosure, or joining initiatives such as Zero Day Quest, researchers continue to play a vital role in protecting customers around the world.”<\/p>\n

Bug bounty programs are booming<\/p>\n

Bug bounty programs have long been a means for enterprises to weed out vulnerabilities that have flown under the radar, either during development or in the wake of updates.<\/p>\n

With AI now in the mix, researchers are accelerating vulnerability hunting, identifying more flaws than ever. Some programs are struggling to keep up with the volume of reports, however.<\/p>\n

Moreover, AI-generated reports are proving troublesome for organizations, particularly in the open source community.<\/p>\n

As ITPro reported last year<\/a>, security report triage worker Seth Larson revealed he\u2019d observed a marked uptick in \u201cextremely low-quality, spammy, and LLM-hallucinated security reports\u201d.<\/p>\n

Earlier this year, Daniel Stenberg, lead maintainer of command line interface (CLI) tool Curl, went so far as to shut down<\/a> the firm’s bug bounty scheme after receiving dozens of reports that didn’t actually show a concrete vulnerability.<\/p>\n

FOLLOW US ON SOCIAL MEDIA<\/p>\n

Follow ITPro on Google News<\/a> and add us as a preferred source<\/a> to keep tabs on all our latest news, analysis, views, and reviews.<\/p>\n

You can also follow ITPro on LinkedIn<\/a>, X<\/a>, Facebook<\/a>, and BlueSky<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"Microsoft has dished out its biggest collection of bug bounties ever over the last year, awarding more than…\n","protected":false},"author":2,"featured_media":803531,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[4,450,451,3,452,453],"class_list":["post-803530","post","type-post","status-publish","format-standard","has-post-thumbnail","category-breaking-news","tag-breaking-news","tag-breakingnews","tag-headlines","tag-news","tag-top-stories","tag-topstories"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/803530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=803530"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/803530\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/803531"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=803530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=803530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=803530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}