The company is extending its reward programme to cover vulnerabilities in software that could affect services provided by the company, irrespective of whether it is owned and managed by Microsoft. Microsoft awarded more than $17m to security researchers through its bug bounty programmes and live hacking events this past year, and expects to offer more in 2026. The Redmond-based company said the programme, dubbed "in scope by default", will extend its bug bounty scheme to include serious vulnerabilities that affect Microsoft cloud services.