Microsoft broadens bug bounty scope to include any vulnerability affecting its services – News

Microsoft Corp. announced today that it is expanding its bug bounty program with a new policy that brings all of its online services, including those supported by third-party and open-source components, into its scope by default.

The update, introduced through a new “In Scope By Default” model, marks a significant change to Microsoft’s coordinated vulnerability disclosure ecosystem by dramatically widening what security researchers can report and be rewarded for.

Under the new framework, every Microsoft online service is now automatically eligible for bounty awards from when it launches and, in doing so, eliminates the previous requirement for product-specific scope definitions. The idea is to make participation clearer and more predictable for researchers while also ensuring that critical vulnerabilities are rewarded regardless of where they originate.

The expanded scope includes coverage for flaws in third-party libraries, dependencies or open-source packages that power Microsoft’s cloud infrastructure, not just code and software from Microsoft itself.

Tom Gallagher, vice president of engineering at Microsoft Security Response Center, noted in a blog post that expansion isn’t simply an administrative but a structural shift designed to align incentives with real-world risk. By defaulting all services into scope, Microsoft is aiming to reduce confusion, accelerate reporting and remediation and ensure that researchers can focus on vulnerabilities that have meaningful customer impact.

The change also gives Microsoft greater flexibility to collaborate with researchers on third-party or upstream vulnerabilities, including assisting in developing fixes or supporting maintainers when those flaws directly affect Microsoft services.

“If Microsoft’s online services are impacted by vulnerabilities in third-party code, including open source, we want to know,” explains Gallagher. “If no bounty award formerly exists to reward this vital work, we will offer one. This closes the gap for security research and raises the security bar for everyone who relies on this code.”

As part of the update, all new online services now fall under bounty coverage on day one, while millions of existing service endpoints no longer require manual listing or approval to qualify.

The initial reaction from security professionals has been positive. Martin Jartelius, AI product director at cybersecurity and risk management solutions provider Outpost24 AB, told News via email that “for organizations that rely on bug bounty programs to keep themselves and their customers secure, this is an important step, as it focuses on the full attack surface of an organization.”

“A very common mistake in security is the careless use of scope, or rather de-scoping, of what is included,” he said. “As Mr. Gallagher notes, attackers do not care whether they gain access through ReactToShell or a novel vulnerability in Microsoft components. Microsoft will likely find itself paying out more bounties for a while, but the resulting security improvements will ultimately be a cost-efficient way to strengthen the organization’s overall security posture.”

Image: News/Ideogram