$250,000 up for grabs in Microsoft's latest Windows Bounty Program

Microsoft is offering up to US$250,000 (NZ$332,668/AU$313,047) in a new bug bounty program focused exclusively on ironing out the kinks in Windows 10. This time there's a bigger payout for the Hyper-V bounty.

Last week the company launched the Windows Bounty Program, which includes all aspects of the Windows Insider Preview, as well as Hyper-V, Mitigation bypass, Windows Defender Application Guard and Microsoft Edge.

Microsoft says the program is 'in the spirit of maintaining a high security bar in Windows', and complements the company's long list of defence technologies such as DEP, ASLR, CFC, CIG, ACG, Device Guard, Credential Guard and Windows Defender Application Guard.

The new bug bounty program aims to catch any critical or important remote code execution (RCE), privilege elevation or design flaws that compromise users' security and privacy.'

However, if anyone discovers a vulnerability that Microsoft has already found, the bounty equated to 10% of the highest amount they could have received. In the case of a Hyper-V bounty ($US250,000), researchers would receive a payout of $25,000 if they found a RCE.

Microsoft has conducted several bounties since 2013, which reflects the changing nature of vulnerabilities and priorities in different points in time.

"Microsoft strongly believes in the value of the bug bounties, and we trust that it serves to enhance our security capabilities," the company says.

There are also outstanding bounty programs for .NET and cloud applications, worth up to US$15,000 (NZ$19,960/AU$18,782).

Microsoft says that all security bugs are important, and users should report those bugs to secure@microsoft.com via Coordinated Vulnerability Disclosure (CVD) policy.

Interested researchers can also check out Bugcrowd's list of current bug bounty programs from platforms such as Atlassian, Avira, Centrify, Cylance, HubSpot and 1Password.

However, bug bounty programs may not be alluring enough for some – recent reports suggest that Google's bug bounties are not doing so well. Earlier this year the company's Project Zero hacking contest failed to reward a single prize, despite rewards of up to US$200,000.

In the contest, there were no valid entries or bugs - instead there was just spam and entries that did not resemble what the company was after. Read more here.

Microsoft's bug bounty categories are below.