Reward-related cybersecurity coverage examines bug bounties, vulnerability disclosure incentives, and how compensation can influence reporting and risk.
Search across headline titles and summaries.
Background for this topic.
Reward in information security usually means compensation offered for finding and responsibly reporting a vulnerability, commonly through a bug bounty or vulnerability disclosure program. Payment may depend on severity, exploitability, affected assets, report quality, and whether the issue is previously known. Some programs also reward information that helps identify active abuse or improve defenses, but the intended activity and eligibility should be explicitly defined.
Rewards can extend defensive testing beyond an organization’s internal teams, but they require clear scope, reporting channels, response targets, and rules for handling sensitive data. Without these controls, researchers may test unauthorized systems, expose personal information in proof-of-concept material, submit duplicates or invalid findings, or dispute inconsistent decisions. Security teams should connect accepted reports to vulnerability management: validate and prioritize findings, track remediation, communicate disclosure decisions, and preserve evidence. Program metrics such as response time, remediation time, and recurring vulnerability classes can show whether incentives are improving security rather than merely increasing report volume.
Weekly headline count for the current query.
Google paid over $17 million to 747 security researchers who reported security bugs through its Vulnerability Reward Program (VRP) in 2025. [...]
Dutch authorities arrested a 40-year-old man after he downloaded confidential documents that had been mistakenly shared by the police and refused to delete them unless he received "something in return." [...]
Long after CVEs issued and open source flaws fixed Last fall, Jakub Ciolek reported two denial-of-service bugs in Argo CD, a popular Kubernetes controller, via HackerOne's Internet Bug Bounty (IBB) program. Both were assigned CVEs and have since been fixed. But instead of receiving an $8,500 reward for the two flaws, Ciolek says, HackerOne ghosted him for months.…
Critical vulnerabilities found in third-party applications eligible for award under 'in scope by default' move Microsoft is overhauling its bug bounty program to reward exploit hunters for finding vulnerabilities across all its products and services, even those without established bounty schemes.…
Bitcoin bridge biz offers 10 percent reward to attackers if they play nice Blockchain company Garden admits it was compromised and temporarily shut down its app after approximately $11 million worth of assets were stolen.…
Apple has doubled its top bug bounty reward to $2m but with bonuses it could reach $5m
Apple is announcing a major expansion and redesign of its bug bounty program, doubling maximum payouts, adding new research categories, and introducing a more transparent reward structure. [...]
Google has introduced a new AI Vulnerability Reward Program offering up to $30,000 for bug discoveries in its AI products
This week, Google has launched an AI Vulnerability Reward Program dedicated to security researchers who find and report flaws in the company's AI systems. [...]
The U.S. Department of State is offering a reward of up to $10 million for information on three Russian Federal Security Service (FSB) officers involved in cyberattacks targeting U.S. critical infrastructure organizations on behalf of the Russian government. [...]
Europol has confirmed that a Telegram channel impersonating the agency and offering a $50,000 reward for information on two Qilin ransomware administrators is fake. The impostor later admitted it was created to troll researchers and journalists. [...]
The Pwn2Own competition is offering a $1m reward to any teams able to unearth a WhatsApp code execution exploit
The Zero Day Initiative is offering a $1 million reward to security researchers who will demonstrate a zero-click WhatsApp exploit at its upcoming Pwn2Own Ireland 2025 hacking contest. [...]
The U.S. Department of State has announced a reward of up to $10 million for any information on government-sponsored hackers with ties to the RedLine infostealer malware operation and its suspected creator, Russian national Maxim Alexandrovich Rudometov. [...]
Coinbase asserts that this number is only a small fraction of the number of its verified users, though its still offering a $20 million reward to catch the criminals.
Coinbase is offering a $20m reward to help catch the threat actor behind a cyber-attack that could cost it between $180-$400m
All Risk, No Reward: Meta's Ongoing Legal Issues in EuropeSocial media giant Meta is likely to face more legal hurdles over its plans to use the personal data of European Facebook and Instagram users to train artificial intelligence models. Meta paused efforts to train AI with European data in June 2024.
Thousands tricked by fake reward & toll scam texts. CTM360 exposes PointyPhish & TollShark—SMS phishing campaigns powered by the Darcula PhaaS platform, with 5K+ domains stealing payment info worldwide. [...]
The artificial intelligence research company previously had its maximum payout set at $20,000 before exponentially raising the reward.
Google paid almost $12 million in bug bounty rewards to 660 security researchers who reported security bugs through the company's Vulnerability Reward Program (VRP) in 2024. [...]