Microsoft massively expands the scope of its bounty program

Microsoft is just one of many technology firms that have a bounty program that offers financial rewards for anyone who discovers security flaws in its products and services. The company has just announced a huge expansion of the scheme so it even covers problems found in third party code.

Vice President of Engineering at Microsoft Security Response Center, Tom Gallagher, announced the broadened scope at Black Hat Europe. He stressed that “keeping our customers secure is our top priority”.

The change does not mean that Microsoft will pay out money for the discovery of literally any security flaw that is discovered, but if the problem affects its products and service – including online and AI – it does not matter whether the code in question is Microsoft’s or a third party’s.

Gallagher says:

Starting today, if a critical vulnerability has a direct and demonstrable impact to our online services, it’s eligible for a bounty award. Regardless of whether the code is…