Microsoft promises more bug payouts, with or without a bounty program

Microsoft announced at Black Hat Europe an overhaul of its bug bounty program to an in scope by default model, offering rewards for critical vulnerabilities across all Microsoft-managed products and services, including third-party and open-source components, with standardized payouts by severity and class. The approach extends coverage to new products at launch, targets high-risk areas across cloud and AI, and anticipates increased spending beyond the $17M awarded last year, while acknowledging ongoing community concerns about response times and triage raised to the Microsoft Security Response Center and reported by outlets like *The Register*.