Microsoft Introduces New Bug Bounty Rules That Could Affect Security Researchers’ Rewards

Microsoft has introduced new rules for assessing reports in its bug bounty programs, tying submission completeness more directly to potential rewards.

Announced by the Microsoft Security Response Center (MSRC) on October 20, 2026, these changes replace the previous multiple report quality levels with two assessments: “Complete” and “Not Complete.”

This updated approach establishes clearer expectations for researchers documenting vulnerabilities.

New Bug Bounty Rules

The new rules apply to reports submitted on or after October 20, 2026, at 8 AM Pacific Time. Earlier submissions will still follow the previous report quality requirements.

Microsoft aims to minimize requests for missing information, enabling MSRC and engineering teams to reproduce vulnerabilities, assess their implications, and address security issues more efficiently.

Under the revised framework, a “Complete” report must include all necessary information and supporting evidence to understand, reproduce, and evaluate a vulnerability.

In contrast, a “Not Complete” submission lacks one or more required elements or artifacts. Reports deemed “Complete” may receive higher bounty rewards than “Not Complete” submissions, underscoring the importance of thorough initial documentation for researchers’ potential compensation.

Completeness is separate from the severity and security impact of the vulnerability. A technically thorough submission does not automatically indicate that an issue is severe, falls within a bounty program’s scope, or qualifies for payment. Microsoft will continue to evaluate these factors independently.

Thus, the announcement modifies how reporting quality affects awards but does not make completeness a substitute for technical impact.

To achieve a “Complete” assessment, researchers must provide clear reproduction steps, a reliable and minimal proof of concept, and specify the vulnerability type.

Reports should also include detailed and accurate technical analysis that identifies the root cause whenever possible. Researchers must indicate the affected environment and platform, relevant versions, and the affected component when applicable.

Submissions should also explain exploitability by detailing the attacker’s position, prerequisites, and conditions needed to trigger the vulnerability. Impact descriptions must clarify what an attacker could achieve and which resources or systems are affected.

Together, these details should enable Microsoft to validate the finding with little or no additional communication.

Supporting evidence will vary by product category and vulnerability class. Microsoft identified several potentially required artifacts, including crash dumps, Time Travel Debugging traces, call stacks, proof-of-concept source code, Process Monitor logs, packet captures, and video demonstrations.

Some reports must also explain how an attacker can reach the information to demonstrate that the claimed exposure is valid.

For on-premises products, findings related to memory corruption and denial of service may require crash data, call stacks, and proof-of-concept source code.

File redirection reports might need Process Monitor logs, while NTLM coercion and relay submissions may require packet captures. Web application reports can include video demonstrations and relevant scripts. Submissions related to AI vulnerabilities must continue to follow Microsoft’s published AI reporting guidelines.

Crucially, Microsoft will assess completeness based on the documentation and evidence provided in the initial submission. While MSRC may request clarification, researchers should not assume that later communications will establish initial completeness.

Consequently, researchers seeking higher eligible rewards must include reproducible findings, accurate analysis, and vulnerability-specific artifacts in their submissions, while consulting the applicable program requirements rather than relying solely on a generic report template.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.