Microsoft Pays Record $20 Million in Bug Bounties

Microsoft awarded a record $20 million to 562 security researchers over the past year, marking a significant increase in its bug bounty payouts as artificial intelligence accelerates the discovery of software vulnerabilities. The company disclosed the figures this week, covering its fiscal year from July 1, 2025, to June 30, 2026.

The total payout eclipses the previous record of $17 million distributed to 344 researchers in the prior year. The latest awards went to researchers across 64 countries, with the largest single payout reaching $200,000. Microsoft credited the increase to both expanded program rules and a surge in reports driven by AI-assisted research.

A key factor in the higher total was a policy shift implemented in December 2025 known as "In Scope By Default." This expansion made vulnerabilities in eligible open-source software, third-party components, and Microsoft cloud services eligible for rewards, areas previously outside traditional bounty scopes. The company said this change generated over 300 additional reports and more than $800,000 in awards for flaws that would not have qualified before.

Another major contributor was the Microsoft Zero Day Quest, a live...