Microsoft Security Response Center

We’re updating the Microsoft 365 Bounty Program to make program scope clearer for researchers. One of the biggest changes: we’re shifting from domains to services, making it easier to understand which Microsoft 365 services are included in the program and how eligible research maps to them.

Security researchers play an essential role in helping Microsoft protect customers, and we appreciate the time and expertise that goes into every vulnerability report. Many researchers already provide the detailed, actionable reports our teams need to reproduce and assess vulnerabilities quickly.

Security updates for October 2026 are now available. Details are here: msrc.microsoft.com/update-guide/

As security update packages address more CVEs, prioritization can become more complex. In a new blog, we explore risk cohorts, an approach to grouping CVEs around shared deployment, exposure, and trust-boundary questions to help customers make vulnerability analysis more manageable.

That’s a wrap on BlueHat Asia. Over the past two days, security researchers, defenders, engineers, and security leaders came together to share new research, challenge assumptions, and strengthen the security community.

Thank you to everyone who made this event possible, including our attendees, presenters, Microsoft teams, and Microsoft Most Valuable Researchers (MVRs) who traveled from around the world to be part of the conversation.

Day 2 of BlueHat Asia opened with remarks from Jeff Moss, founder of DEF CON and Black Hat, who reflected on the lessons he's learned from building security communities and navigating decades of technological change.

Jeff described this as a golden age for both offense and defense. AI is creating opportunities to automate routine tasks, allowing researchers and defenders to spend more time on creative work and innovation. The goal isn't replacing human creativity, but creating more opportunities to apply it.

Day 2 of BlueHat Asia opened with remarks from Jeff Moss, founder of DEF CON and Black Hat, who reflected on the lessons he's learned from building security communities and navigating decades of technological change.

He also noted that it's impossible to please everyone all the time. Whether building products, communities, or security programs, leaders must understand who they are trying to serve and use that audience as their north star.

Day 2 of BlueHat Asia opened with remarks from Jeff Moss, founder of DEF CON and Black Hat, who reflected on the lessons he's learned from building security communities and navigating decades of technological change.

It requires experimentation, puzzle solving, and a willingness to ask "what if?" Failure is part of the process, and many of the best ideas emerge from people willing to experiment and learn.

Day 2 of BlueHat Asia opened with remarks from Jeff Moss, founder of DEF CON and Black Hat, who reflected on the lessons he's learned from building security communities and navigating decades of technological change.

Jeff described the hacking community as his first real community, a place where people learned from one another and built lasting relationships. That experience shaped one of the central themes of his talk: no one can know everything. Success depends on having trusted people you can ask for advice.

Day 2 of BlueHat Asia opened with remarks from Jeff Moss, founder of DEF CON and Black Hat, who reflected on the lessons he's learned from building security communities and navigating decades of technological change.

As BlueHat Asia kicks off, we had the opportunity to spend an evening with some of the people who make this community so special.

A heartfelt thank you to our presenters and MVRs for sharing their expertise, insights, curiosity, and passion for advancing security. BlueHat is made possible by the incredible people who come together to learn from one another.

As BlueHat Asia kicks off, we had the opportunity to spend an evening with some of the people who make this community so special.

Tomorrow, security researchers and defenders from around the world will gather in Singapore for BlueHat Asia 2026.

With two days of technical talks, keynotes, networking, and hands-on security villages, the agenda features talks from leading security researchers and Microsoft engineers, covering everything from AI-powered security research and cloud defense to identity attacks.

Tomorrow, security researchers and defenders from around the world will gather in Singapore for BlueHat Asia 2026.

The event will feature keynote presentations from Halvar Flake, who will explore today’s "Age of Experimentation" in AI and engineering systems, and Tom Gallagher, VP of Engineering, MSRC, who will share his perspective on building security resilience at scale.

We're pleased to welcome Jeff Moss @thedarktangent.defcon.social.ap.brid.gy, founder of DEF CON and Black Hat, to BlueHat Asia 2026, where he'll deliver the conference opening remarks.

Beyond his work building two of the world's most influential security events, Jeff has served in advisory roles spanning cybersecurity, Internet governance, and public policy, bringing a unique perspective on how the security landscape continues to evolve.

We're pleased to welcome Jeff Moss @thedarktangent.defcon.social.ap.brid.gy, founder of DEF CON and Black Hat, to BlueHat Asia 2026, where he'll deliver the conference opening remarks.

Researchers can now earn up to $60,000 USD for qualifying critical vulnerabilities through the updated Microsoft Dynamics 365 and Power Platform Bug Bounty Program.

Key updates include: ➤ Up to $60,000 USD in awards for qualifying critical vulnerabilities ➤ New cross-tenant award multipliers for select scenarios ➤ More granular severity and impact-based award categories

We're excited to announce Tom Gallagher Vice President of Engineering at the Microsoft Security Response Center (MSRC), as a keynote speaker at BlueHat Asia.

The keynote will explore how scale, simplicity, and disciplined engineering shape security outcomes, and why building resilience requires coordinated action across products, platforms, and people.

We're excited to announce Tom Gallagher Vice President of Engineering at the Microsoft Security Response Center (MSRC), as a keynote speaker at BlueHat Asia.

In his keynote, “Accelerated Response by Design,” Tom reflects on the challenge of securing one of the world's largest and most complex technology ecosystems.

Security updates for September are now available: msft.it/6018SZEg0

Alongside this month's release, we're expanding machine-readable Vulnerability Exploitability eXchange (VEX) coverage to all Microsoft-assigned CVEs, providing customers with more consistent, machine-readable security information to help understand exposure and prioritize risk.

Security researchers help make Microsoft's products and services more secure every day. To support that work, we're introducing new MSRC Researcher Portal enhancements designed to provide clearer guidance, better visibility into report status, and improved ways to manage vulnerability submissions.

Researcher Portal enhancements include Review with AI, improved report search and filtering, dashboard summary tiles, visual case status tracking, and a centralized activity feed that helps researchers stay informed throughout the vulnerability reporting process.