Microsoft announced a significant overhaul of its bug bounty program. The company expanded the scheme to reward security researchers for finding critical vulnerabilities across all its products and services, including those without established bounty schemes.
This new "in scope by default" approach specifically includes vulnerabilities found in third-party and open-source code. This coverage applies when the code impacts Microsoft's online services.
Microsoft made the announcement at the Black Hat Europe conference. The program aims to incentivize research into the highest-risk areas, seeking to strengthen security across its cloud and AI platforms.
Last year, Microsoft paid over $17 million in bounties. The company expects this broader scope to increase that spending. No market analysis on the potential impact on investor sentiment is currently available due to the timing of the announcement.