Katie Moussouris: Getting Microsoft to Pay for Bugs

Katie Moussouris has spent her career persuading powerful institutions to do something that sounds insane: invite hackers in and pay them for what they find.

She sold the idea to Microsoft, which took three years. She sold it to the Pentagon, which had never paid a hacker for anything. Then she took Microsoft to court, and found out how hard an institution will fight to avoid being embarrassed.

In June 2026 her name surfaced somewhere nobody expected: at the center of a fight between the US government and an AI company over three words typed into a chatbot.

Katie Moussouris at a Glance

• Born in Boston to a Chamorro mother and a Greek father, Moussouris got a Commodore 64 at eight and, with no money for games, wrote her own.
• She worked on the Human Genome Project at MIT's Whitehead Institute, then as a systems administrator and Linux developer, before turning professional hacker as a penetration tester.
• At Microsoft from 2007 to 2014 she founded the company's vulnerability research program and spent three years persuading executives to launch its first bug bounty, which paid out a $100,000 reward within months.
• At HackerOne she helped the Department of Defense launch "Hack the Pentagon" in 2016, the first bug bounty in the federal government, which turned up 138 flaws for $150,000.
• She co-authored the ISO standards for vulnerability disclosure and handling and advised US negotiators on the Wassenaar Arrangement's export controls on "intrusion software."
• In 2016 she founded Luta Security, named for the island her family comes from, and in 2018 testified to the Senate about the Uber breach and bug bounties.
• Her 2015 gender-discrimination lawsuit against Microsoft never won class status; she dropped it in 2020 and launched the Pay Equity Now Foundation instead, giving $1 million to Penn State Law.
• In 2026 she became the most prominent outside voice in the controversy over US export restrictions on Anthropic's Fable 5 and Mythos 5 models.

The Life of Katie Moussouris

Moussouris's Early Years

Katie Moussouris was born in Boston to a Greek father and a mother of Chamorro descent from Rota, a small island in the Northern Marianas. Her mother was a scientist who studied reproduction and expected excellence.

At eight she got a Commodore 64 and a programming manual. There was no money for games, so she wrote her own.

Her family, she likes to point out, "were the chiefs of that tiny island in the middle of nowhere." It's a line she uses to explain a lifelong refusal to be intimidated.

From Genomes to Penetration Tests

As a student she worked on the Human Genome Project at MIT's Whitehead Institute, then drifted toward the machines, running systems for university departments and developing for Linux.

The hobby became a job at @stake, the Boston consultancy that'd absorbed the L0pht hacker collective, where she worked as a penetration tester. She spent seven years as a professional hacker, breaking into systems for clients who'd asked her to.

Microsoft's Vulnerability Diplomat

In 2007 Moussouris joined Microsoft as a security strategist. The company was still at war with the researchers who kept finding holes in Windows, and she made it her job to end it.

She founded Microsoft Vulnerability Research, a program for reporting bugs Microsoft found in other companies' software, and ran the Security Community Outreach and Strategy team inside the Microsoft Security Response Center.

The bigger fight was over money. For three years she argued that paying researchers for vulnerabilities would drain the underground market for zero-days and heal the rift with hackers, Wired reported. In June 2013 Microsoft announced its first bug bounty, with up to $100,000 for a new way to defeat Windows' exploit mitigations and up to $11,000 for Internet Explorer 11 bugs.

That October the company paid out its first full $100,000, to British researcher James Forshaw.

The Standards Writer

Bug bounties only work if companies know what to do when a report arrives. Moussouris co-authored the two ISO standards that spell it out: ISO/IEC 29147 on vulnerability disclosure and ISO/IEC 30111 on handling the bugs once reported.

She also waded into arms control. In 2013 the Wassenaar Arrangement, the export-control pact covering weapons and dual-use goods, added "intrusion software" to its lists, in language that researchers warned would catch ordinary security work in a policy "dragnet."

Moussouris became a technical adviser to the US delegation and helped rewrite the rules.

HackerOne and the Pentagon

In 2014 she left Microsoft for HackerOne, the bug bounty platform, as its chief policy officer.

She'd started talking to the federal government about bounties while still at Microsoft. The result was "Hack the Pentagon," launched on April 18, 2016: the first bug bounty program in the history of the US government.

More than 1,400 hackers registered. They found 138 valid vulnerabilities, every one of which had escaped the department's previous penetration tests, and the whole program cost $150,000, about half of it in bounties. An outside audit, the government estimated, would've cost $1 million.

Luta Security

Two weeks before the Pentagon program opened, Moussouris struck out on her own. In April 2016 she founded Luta Security, named after the island her family comes from.

The company is self-funded, has taken no outside investment, and works a 32-hour week: everyone is paid for forty hours, and Fridays are off.

On February 6, 2018, she sat before a Senate subcommittee alongside Uber's security chief and HackerOne's chief executive to explain what bug bounties can and can't do, in the wake of Uber's 2016 breach. In 2021 she testified to the House on software supply chains.

Moussouris v. Microsoft

In September 2015 Moussouris sued her former employer in federal court in Seattle, alleging that Microsoft had passed her over for raises and promotions in favor of less qualified men.

Two other women joined, and in June 2018 their lawyers asked Judge James Robart to let the case represent some 8,600 women who'd held technical jobs at Microsoft since 2012. He said no, and the Ninth Circuit declined to revive the class.

Microsoft offered to settle. She called the offer "a complete insult," and in November 2020 she dropped the case.

"I will not live to see pay equity at the current trajectory," she told The Verge, "and I found that to be unacceptable." She founded the Pay Equity Now Foundation, whose pledge asks companies to admit bias, audit for it and fix it, and gave $1 million to Penn State Law to establish a lab devoted to gender and economic equity.

'Fix This Code'

In June 2026 the Commerce Department invoked export controls against Anthropic's two most capable models, Fable 5 and Mythos 5, barring their use by non-US persons. Anthropic responded by switching both models off for everyone.

The trigger was a research paper by Amazon security researchers describing how the models could be coaxed into security work the guardrails were meant to refuse. Moussouris said she was the only outside expert who'd read it.

Her verdict was blunt: "It's not a jailbreak," she said. "It was Defense Oriented Prompting (DOP), capabilities defenders need." The researchers, she explained, had handed the models vulnerable code and typed "fix this code," and the models fixed it.

She called the order "hasty, heavy-handed, and misguided," and she and dozens of other security veterans asked the administration to revoke it, TechCrunch reported. Defenders, they argued, need AI that can find and fix bugs at least as much as attackers do.

Moussouris Today

Luta Security is now a decade old. Moussouris sits on the Commerce Department's Information Systems Technical Advisory Committee, gave the commencement address at Penn State's College of Information Sciences and Technology in May 2024, and is a keynote speaker at SentinelOne's LABScon in Scottsdale in September 2026.

She told an interviewer in 2020, "I will run for President. Everything I decide to do, eventually I do." Nobody who's watched her career is betting against it.

Katie Moussouris: Paid to Break In

Bug bounties are so ordinary now that it's easy to forget they were once a radical idea, and that one person pushed them through the two most change-resistant institutions in American technology.

Moussouris's second act has been about the rules: who gets paid, who gets promoted, what counts as a weapon and what counts as defense. She tends to lose the first round and win the argument.

In 2026 the argument is about machines that fix code on command. She's already read the paper.