Microsoft Researcher Recognition Program

The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers through discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.

Anyone who submits a security vulnerability to the Microsoft Security Response Center (MSRC) is eligible to participate.

To view our leaderboards, please visit the MSRC Leaderboard site.

Program Overview

We award researchers points for each valid submission to the MSRC, and accumulated points earn researchers recognition on Microsoft’s Quarterly, Annual, and Technical Leaderboards, with the Top 100 from the Annual Leaderboard gaining the title of Most Valuable Researcher (MVR). MVRs may receive profile badges and swag for achievements in high impact, high accuracy research, and volume for their research. 

How do points work?

It works like this:

*Microsoft Security Response Center does not currently service vulnerabilities in GitHub or LinkedIn. To report an issue, go to GitHub’s Bug Bounty Program and LinkedIn’s Bug Bounty Program.

Duplicate Weighting

What if I report a vulnerability someone else already reported?

If you are the first person to submit a report for an unpatched vulnerability, you receive 100% of the points.

If you are the second to submit a report, you receive 50% of the points.

Additional reports of the same issue receive no points.

Leaderboards

Quarterly Leaderboard

Each quarter, we recognize all researchers who have received more than 20 points. In addition, we recognize researchers in specific research and technology areas in our Technical Leaderboards. Quarterly Technical Leaderboards recognize research in Azure, Office, and Windows. 

Annual Leaderboard

Each year, we recognize researchers who have received over 20 points over the entire program period. Each program period runs from July 1 to June 30. For example, the 2022/2023 program period runs from July 1, 2022, to June 30, 2023. 

Annual leaderboards include technical leaderboards for Azure, Office, Windows, and Dynamics. Researchers who do not make the MVR top 100 are eligible for quarterly leaderboards and will receive accuracy, impact, and volume badges where applicable on the published leaderboard page, but will not receive a digital form of the badge.  

Technical Leaderboard

Technical Leaderboards recognize researchers who have distinguished themselves through high-impact research in specific areas, including Azure, Office, and Windows on a quarterly basis, and Dynamics on an annual basis. Technical leaderboards publish the top 10 ranks for each technical group for both Quarterly and Annual Leaderboards. Badges for technical leaderboards will be calculated using the points of only those cases that pertain to the technical research areas. 

Most Valuable Researcher

The top 100 researchers from the Annual Leaderboard will receive the title of Most Valuable Researcher and will receive digital badges. 

Digital Badges

Digital badges highlight researchers’ accomplishments throughout a program period and can be shared on professional profiles and social media such as LinkedIn and Twitter. The first badge recognizes our 2020 Most Valuable Security Researchers, with more badges to come!

• Accuracy Badge: Recognizes researchers with 100% accuracy, meaning all their submissions were valid vulnerability reports 

• Impact Badge: Recognizes high-impact work, with the average points per valid vulnerability report at or above the 90th percentile 

• Volume Badge: Recognizes a larger body of work, requiring at least five valid vulnerability reports 

Swag

Each year, a specifically designed SWAG box is sent to Microsoft’s Most Valuable Security Researchers (MVRs). This generally happens in the Fall after the annual MVR announcement, and each researcher eligible for a SWAG box will be notified by our team.

SITE MAINTENANCE ANNOUNCEMENT:

We are making updates to how we publish our leaderboards! You can find the most recent leaderboards on our MSRC leaderboard site! Legacy leaderboards listed below will be migrated over within the next few weeks. 

Recognition Period

This 2022 Q4 leaderboard reflects point values for cases that are:

• Submitted and assessed by the MSRC team between October 1, 2022, and December 31, 2022 
• Submitted between July 1, 2022, and September 30, 2022 (last program period), but assessed after October 1, 2022.

2022 Q3 Security Researcher Leaderboard

Click here for the full list of the researchers recognized this quarter.

Recognition Period

This 2022 Q3 leaderboard reflects point values for cases that are:

• Submitted and assessed by the MSRC team between July 1, 2022, and September 30, 2022
• Submitted between April 1, 2022 and June 30, 2022 (last program period), but assessed after July 1, 2022

2021/2022 Recognition Period

Dates: July 1, 2021 – June 30, 2022

2022 Most Valuable Researchers

Click here for the full list of researchers recognized.

2022 Q2 Security Researcher Leaderboard

Click here for the full list of the researchers recognized this quarter.

Recognition Period

This 2022 Q2 leaderboard reflects point values for cases that are:

• Submitted and assessed by the MSRC team between April 1, 2022, and June 30, 2022
• Submitted between January 1, 2022 and March 31, 2022 (last program period), but assessed after April 1, 2022

2022 Q1 Security Researcher Leaderboard

Click here for the full list of researchers recognized this quarter.

Recognition Period

This 2022 Q1 leaderboard reflects point values for cases that are:

• Submitted and assessed by the MSRC team between January 1, 2022, and March 31, 2022
• Submitted between October 1, 2021 and December 31, 2021 (last program period), but assessed after January 1, 2022

2021 Q4 Security Researcher Leaderboard

Click here for the full list of researchers recognized this quarter.