Getting to $10,000 – the variables at play in determining bounty awards
summary
Microsoft’s bug bounty program explains how impact, product priority and report completeness drive awards, not just vulnerability type. It uses the STRIDE model to score impact; cloud RCE tops at $20,000, Windows criticals up to $50,000, and Hyper‑V bugs can reach up to $250,000 for Hyper‑V. Concrete guidance: include repro steps, versions, configs, attack vectors, root‑cause analysis and suggested fixes; a low-quality elevation-of-privilege example pays ~$1,000, adding repro doubles it, and full analysis multiplies payout to several thousand. New policies pay faster on repro and credit first external finders.
AI-written summary · about
chapters (13)
- 0:00Introduction to bounty program
- 1:07Program scope and rewards
- 3:35Key takeaways for higher bounties
- 4:18Reading bounty briefs for impact
- 5:20STRIDE model for vulnerability impact
- 6:45Quality and completeness of reports
- 7:49Real-world report quality examples
- 10:14Advanced analysis for higher rewards
- 12:21Tips to improve report clarity
- 13:26Program improvements and changes
- 15:50Additional resources and future plans
- 17:13Summary and next steps
- 18:37Q&A session
related talks
30mBeyond Quick Cash: Rethinking Bug Bounties for...
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
43mHard Knock Lessons On Bug Bounties
56mBounties and the SDLC
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
07mLessons learned from running big bug bounty programs