Microsoft raises Zero Day Quest bug bounties to US$5 million

Microsoft has raised the total potential rewards for its Zero Day Quest bug bounty program from US$4 million to US$5 million (A$6.18 million to A$7.73 million respectively) for the 2026 event, the tech giant announced.

The top bounties will be awarded for high-impact research in cloud and artificial intelligence, targeting Microsoft Azure, Copilot, Dynamics 365/Power Platform, Identity and M365.

Zero Day Quest (ZDQ) starts with a research challenge that runs from August 4 to October 4 this year, United States time.

During the research challenge, vulnerability submissions targeting specific scenarios become eligible for enhanced bounty awards, with Microsoft offering a 50 percent multiplier for critical severity discoveries.

Successful participants in the research challenge can then earn invitations to a live hacking event at Microsoft's Redmond campus in the spring of 2026, styled by the company as the largest public hacking get-together ever.

This invitation-only gathering brings together the world's leading security researchers to collaborate directly with Microsoft product teams and the Microsoft Security Response Centre (MSRC).

ZDQ operates under the company's coordinated vulnerability disclosure (CVD), which encourages researchers to share their findings publicly, once vulnerabilities are fixed or mitigated.

Microsoft will support transparency under the CVD, through blogs, podcasts, and videos, to help the security community learn from discoveries.

The 2025 ZDQ event received over 600 million vulnerability submissions, with US$1.6 million being awarded in the two phases of the program.

Microsoft's paid millions in bug bounties

Separately, the MSRC took stock of its current bounty initiatives, and said they have distributed some US$17 million to 344 security researchers in 59 countries.

This is the highest total amount of money awarded in the history of the Microsoft Bug Bounty Program, the company said.

Beyond the ZDQ, the umbrella Microsoft bug bounty program comprises nine cloud programs, six platform ones, and four defence and grant programs and challenges.