Microsoft doubled down on cloud security at this week's Black Hat event in Las Vegas with the launch of Azure Security Lab, a set of dedicated cloud hosts for white hat hackers to research vulnerabilities in Azure and try to exploit them, and the announcement that it is doubling its Azure bug bounties to $40,000 per vulnerability.

The bug-bounty program includes new scenario-based challenges with bounties up to $300,000 for specific challenges in Azure Security Lab and Microsoft said it will offer $2 million in rewards for participants throughout the year.

It’s also accepting applications to join the Azure Security Lab. Security researchers can fill out a survey and request a Windows or Linux virtual machine.

In addition to offering a secure testing space, the new Azure lab program will give participants access to Azure security experts. This will include access to quarterly campaigns for targeted scenarios “with added incentives,” fame, and fortune — or, more accurately, what Microsoft describes as “regular recognition and exclusive swag.”

While the Microsoft Azure Bug Bounty program isn’t new, the potential $40,000 reward per bug and the new Azure Security Lab challenge represent big price hikes in the amount that Microsoft will pay researchers to identify security flaws. The reward program now offers between $500 and $40,000 per qualified submission, plus up to $300,000 for the lab challenge.

Microsoft said it paid $4.4 million in bounty rewards over the past 12 months. This reflects the importance of vulnerability rewards programs as they help companies catch bugs before hackers find and exploit them in the wild. Those exploitations can cost businesses exponentially more in lost revenue and reputation damage compared to paying white hats to find and report them first.

Case in point: the Apache Struts vulnerability, which cost Equifax more than $1.4 billion dollars to clean up and revamp its cybersecurity program following the 2017 data breach.

According to Bugcrowd’s most recent report published earlier this month, the average payout for a critical vulnerability in 2019 is $2,700, an almost 30% increase over last year. It also reported a 29% increase in the number of programs launched in the first half of 2019, and a 50% increase in public programs launched.

Google is among the companies paying bigger rewards for security bugs. Last month it announced an across the board increase in payouts including tripling the maximum baseline reward amount from $5,000 to $15,000 and doubling the maximum reward amount for high quality reports from $15,000 to $30,000.

Since starting the Chrome Vulnerability Rewards Program in 2010, it has received more than 8,500 reports and paid out more than $5 million dollars.