Microsoft has raised the total rewards for its Zero Day Quest (ZDQ) bug bounty program from US$4 million to US$5 million for the 2026 event. The program focuses on uncovering vulnerabilities in the company’s enterprise offerings.
Top payouts will go to high-impact research in cloud and artificial intelligence, targeting platforms such as Microsoft Azure, Copilot, Dynamics 365/Power Platform, Identity, and Microsoft 365.
The 2025 research challenge runs from August 4 to October 4, during which submissions for specific vulnerability scenarios are eligible for enhanced awards. Critical severity discoveries will receive a 50 percent bonus on the standard bounty rate.
Researchers who perform well in the challenge may be invited to a live hacking event at Microsoft’s Redmond campus in spring 2026. The company describes it as the largest public hacking gathering to date, bringing together leading security experts to work directly with Microsoft product teams and the Microsoft Security Response Centre (MSRC).
ZDQ follows Microsoft’s coordinated vulnerability disclosure policy, allowing researchers to share their findings publicly once fixes or mitigations are in place. Microsoft plans to promote transparency through blogs, podcasts, and videos, sharing insights from the program with the wider security community.
The 2025 ZDQ event drew more than 600 million vulnerability submissions, with US$1.6 million awarded across its two phases.
Separately, the MSRC reported that Microsoft has paid US$17 million in bug bounties to 344 security researchers in 59 countries — the highest annual total in the history of the program. The wider bug bounty initiative includes nine cloud programs, six platform programs, and four defence and grant challenges.
