Microsoft has awarded a record $20 million to ethical hackers through its Bug Bounty Program, marking the largest payout since the initiative began. The tech giant announced that from July 1, 2025, to June 30, 2026, it distributed $20 million among 562 security researchers, averaging roughly $35,000 per person.
A significant contributor to this record sum was the Microsoft Zero Day Quest, a dedicated event held at Microsoft’s Redmond campus. This challenge invited ethical hackers and researchers from 20 countries to focus on high-priority security scenarios across Microsoft’s cloud and AI platforms. It generated approximately 700 vulnerability reports and resulted in $2.3 million in awards.
Another key driver was a separate event that tasked researchers with finding bugs in open-source software, third-party components, and Microsoft cloud services. This effort produced over 300 additional vulnerability reports and more than $800,000 in payouts for previously undiscovered flaws.
Notably, the geographic reach of the program expanded from 59 countries in 2025 to 64 countries in 2026. In the previous year, Microsoft paid $17 million to 344 researchers, averaging about $49,000 per person. The per-person payment decreased this year due to the larger number of participants.
Cyberattacks are becoming increasingly sophisticated, and no company can identify every security flaw on its own. That’s why major technology firms are collaborating with ethical hackers rather than treating them as outsiders. These partnerships help companies release security updates much faster. As threats evolve, collaboration with ethical researchers remains one of the strongest defenses to keep software secure.