News and Analysis

Microsoft has dished out its biggest collection of bug bounties ever over the last year, awarding more than $20 million to 562 security researchers.Microsoft Security Response Center (MSRC) said the figure was well up on the $17 million distributed the year before to 344 researchers from 59 countries – itself a Microsoft Bounty Program record.Part of the reason for the increase is the company’s new ‘In Scope By Default’ policy. Last year, it expanded its vulnerability awards portfolio to recognize ‘impactful’ research that fell outside the scope of traditional bounty programs, including eligible open source software, third-party components, and Microsoft cloud services. Since then, the tech giant said it’s received more than 300 additional reports and awarded more than $800,000 for vulnerabilities that wouldn’t previously have qualified for bounty awards.The firm noted it also saw a notable increase in submission volume during the second half of the year.”Security is a team sport. Every vulnerability reported through our bounty programs represents an opportunity to address risk before it can be exploited against customers,” said the MSRC team. “The work of the research community plays a critical role in helping Microsoft stay ahead of emerging threats while strengthening the security of cloud services, AI systems, enterprise platforms, and consumer technologies.”Microsoft Zero Day QuestThe figures include findings from this year’s Microsoft Zero Day Quest, which saw security researchers from 20 countries meeting at Microsoft’s Redmond campus to collaborate directly with security and engineering teams. This research challenge and live hacking event was focused on high-priority security scenarios across Microsoft’s cloud and AI platforms. That saw nearly 700 vulnerability reports submitted, with researchers collecting $2.3 million in awards.Individual awards depend on the type of vulnerability reported, with cloud programs and Zero Day Quest vulnerabilities capped at $100,000 per vulnerability. Endpoint and on-premises program vulnerabilities, meanwhile, can earn bug-hunters up to $250,000.”This year’s record-breaking results, including more than $20 million in awards and recognition for 562 researchers, reflect the impact of a strong partnership between Microsoft and the global security research community,” said the team.”Whether participating through a traditional bounty submission, collaborating through coordinated vulnerability disclosure, or joining initiatives such as Zero Day Quest, researchers continue to play a vital role in protecting customers around the world.”Bug bounty programs are boomingBug bounty programs have long been a means for enterprises to weed out vulnerabilities that have flown under the radar, either during development or in the wake of updates. With AI now in the mix, researchers are accelerating vulnerability hunting, identifying more flaws than ever. Some programs are struggling to keep up with the volume of reports, however. Moreover, AI-generated reports are proving troublesome for organizations, particularly in the open source community. As ITPro reported last year, security report triage worker Seth Larson revealed he’d observed a marked uptick in “extremely low-quality, spammy, and LLM-hallucinated security reports”.Earlier this year, Daniel Stenberg, lead maintainer of command line interface (CLI) tool Curl, went so far as to shut down the firm’s bug bounty scheme after receiving dozens of reports that didn’t actually show a concrete vulnerability. FOLLOW US ON SOCIAL MEDIA