Microsoft Paid a Record $20 Million. The Average Researcher Took Home $35,000.

The money is there. But the math for individual hunters tells a different story.

I read Microsoft's bug bounty announcement on a Tuesday morning.

The headline was everything the community wanted to hear. $20 million paid to 562 researchers across 64 countries. A record total. Up from $17 million the previous year. The largest single reward: $200,000.

The pie got bigger. Microsoft expanded its scope. More researchers got paid.

Then I scrolled to the second paragraph.

Average earnings per participant dropped from $49,000 to $35,000.

I sat with that for a moment.

The total payout went up. The number of researchers went up. The money each person actually took home went down.

The Math Nobody Talks About

Microsoft paid $20 million to 562 people. That's an average of about $35,587 per researcher.

The previous year: $17 million to 344 researchers. Average: $49,418.

The pool grew by $3 million. The number of people swimming in it grew by 218. Everyone's slice got smaller.

This isn't unique to Microsoft. I've been writing about the numbers behind bug bounty for months. HackerOne's report volume doubled year over year. Bugcrowd saw a 300% spike in submissions during a three-week period before it normalized at roughly double the historical rate. Trend Micro's Zero Day Initiative reported submissions up 450% in April before moderating.

More reports. More researchers. More competition for the same bugs.

What Microsoft Actually Said

I read the full announcement carefully. Microsoft framed the surge as a success story: expanded eligible targets, including open-source dependencies and third-party code. A "dramatic second-half increase in reports driven by artificial intelligence".

They're not wrong. AI-assisted discovery is finding real bugs. Microsoft's Patch Tuesday releases went from 79 fixes in March 2026 to 966 in September — more than ten times as many.

The bugs are real. The fixes are happening. The system is working.

But the system is working for the companies receiving the reports. It's working less well for the individuals writing them.

The Part That Matters for Beginners

I've found one confirmed bug. I'm waiting to be paid. I'm still learning how to write reports that don't get closed in four minutes.

Reading Microsoft's numbers, I felt something I hadn't expected: clarity.

The question I'd been asking was: "How do I compete with AI?"

The better question — the one the data points to — is: "How do I compete with everyone else using AI?"

Because that's what's happening. The tools that make it easier for me to find bugs also make it easier for everyone to find bugs. The barrier to entry has dropped. The pool of hunters has grown. The bugs haven't multiplied to keep pace.

A researcher who found a critical bug in 2024 might have been one of 50 people looking at that target. In 2026, they're one of 500. The bug pays the same. The odds of finding it first have collapsed.

What I'm Taking From This

I can't control the size of the pool. I can't make other researchers stop hunting. I can't compete on volume.

But I can do three things the data suggests actually matter.

First, I'm going deeper on fewer targets. The researchers who are succeeding in this environment aren't scanning everything. They're spending weeks on one application, understanding how it works, finding the bugs that don't show up in scanner output.

Second, I'm treating report quality as a differentiator. If everyone can generate a report with AI, the researcher who writes a report a triager can validate in five minutes stands out. Reproducibility over volume. Clarity over cleverness.

Third, I'm remembering that $35,000 is still a lot of money. The average dropped. But the average is still higher than most beginners will see for years. The path exists. It's just narrower than it used to be.

The Uncomfortable Truth

Microsoft's $20 million payout is genuinely good news. It means the work is valued. It means companies are still investing in finding bugs before attackers do.

But the average earnings drop tells a different story. It says the field is crowding. It says the easy money is gone. It says the researchers who succeed in the next few years will be the ones who adapt to a world where everyone has the same tools.

I don't have a CVE. I've found one confirmed bug. I'm still learning.

But I know what the numbers look like now. And I'm adjusting.

If you're also navigating the numbers behind the bug bounty economy, I write about what I'm actually figuring out — data included. Follow for more field notes from the bottom of the learning curve.