According to a statement on Tuesday, Microsoft said it has spent about $13.7 million on its bug bounty programs between July 2019 and June 2020.
The tech giant runs 15 bug bounty programs, through which 327 researchers have reported 1,226 vulnerabilities.
The largest reward given by the company reached $200,000, with the highest rewards awarded for vulnerabilities discovered in the Hyper-V program.
Researchers can earn up to $250,000 through the Hyper-V bounty program if they report a remote code execution vulnerability affecting the hypervisor and host kernel , but they must submit a high - quality report accompanied by a proof-of-concept containing a working exploit .
Microsoft noted that the total amount paid out in the last year was three times more than what it gave to researchers in the same period the previous year ($4.4 million).
Between July 2019 and July 2020, Microsoft launched six new bug bounty programs and security initiatives, including Dynamics 365, Azure Security Lab, Edge on Chromium, Election Guard, Xbox, and the Azure Sphere challenge. During the same period, it also announced updates to the Identity and Windows Insider Preview programs.
"In addition to the new bug bounty programs, social distancing due to COVID-19 appears to have had an impact on security researcher activity. Across all 15 of our bug bounty programs, we saw strong researcher engagement and higher report volume during the early months of the pandemic," Microsoft said in a post.
