Intel’s live disclosure programme accepts reports but offers no cash bounties

Intel’s live public vulnerability disclosure programme continues to accept security reports, but it offers no financial bounties. The company’s older paid programme was reported suspended in September 2026.

The current programme on Intigriti covers maintained Intel-branded software, firmware, hardware and services. All are listed as no-bounty assets. Intel’s own vulnerability-reporting page directs researchers to use Intigriti for report triage, compliance checks and authentication, confirming that the public reporting route remains open.

The narrower change, based on the programme pages reviewed by 20 September 2026, concerns public cash rewards rather than Intel’s willingness to receive vulnerability reports. Phoronix reported on 18 September that the older paid programme was marked suspended and that a no-bounty programme had appeared. Tom’s Hardware reported the same change the following day, while Hardware Busters separately reported that the legacy programme carried an Application Suspended status.

Intel has not provided an explanation in the current programme material reviewed for this report. The available pages also do not establish whether the suspension is temporary, whether the no-bounty programme is a permanent replacement, or whether other private or event-based reward arrangements exist.

Intel’s public pages give conflicting signals

The live Intigriti terms present the clearest statement of what researchers encounter when making a new public submission: the vulnerability disclosure programme does not pay bounties. However, other pages still describe a paid scheme.

Intel’s separate Bug Bounty Program webpage advertises awards ranging from US$500 to US$100,000 and directs researchers to Intigriti. A publicly viewable legacy Intigriti listing also displays reward tiers from US$250 to US$100,000. Neither page resolves how those older terms relate to the live no-bounty programme.

That mismatch means researchers cannot safely treat the historical reward tables as confirmation that a new report is eligible for payment. The live programme’s terms say otherwise. At the same time, the conflicting documentation may reflect a temporary lag rather than a settled, permanent policy. The material reviewed for this report contains no Intel transition announcement explaining the relationship between the programmes.

The status of reports already submitted, validated or awaiting payment under the previous terms is also unknown. The live no-bounty terms do not establish how Intel will handle those pending cases.

What researchers still receive

Researchers can continue reporting vulnerabilities affecting maintained Intel-branded products through Intigriti. The live programme provides reasonable safe harbour for participants who follow its terms and allows for possible named acknowledgement. Those provisions preserve a coordinated route for notifying Intel and possible recognition, but they are distinct from a financial incentive.

This distinction matters because a vulnerability disclosure programme and a paid bug bounty programme serve related but different functions. Both can provide rules and an intake channel for external findings. A bounty programme additionally offers payment for qualifying work under specified conditions. Intel’s current public channel retains the intake process while listing no monetary rewards.

The change does not show that every Intel-related security report under every possible arrangement is now unpaid. The reviewed sources cover the public programme and do not confirm the status of private, invitation-only or event-based schemes.

A programme with a substantial historical role

Intel says its bounty programme began with a selected group of researchers in 2017 and opened to all eligible members of the public in 2018. The company reported that bounty submissions accounted for 105 of the 231 CVEs it addressed in 2020.

The programme has changed platforms before. Intel announced on 1 December 2021 that it would move its public bounty programme to Intigriti from 6 December and stop accepting new reports through HackerOne on 13 December. That documented migration differs from the present situation because the current pages contain no equivalent announcement explaining the no-bounty arrangement.

Intel’s 2024 Product Security Report said bounty reports accounted for 53 per cent of the vulnerabilities it addressed that year. It also said proactive efforts overall accounted for 96 per cent of vulnerabilities discovered and mitigated. Those figures show that external bounty reports had a substantial documented role, but they do not predict reporting levels or security outcomes under the current model.

Intel added further context in May 2026, saying that 84 per cent of its bug-bounty-eligible vulnerabilities from 2024 were in software and the remainder were in firmware. The company said all 21 hardware vulnerabilities it mitigated during that year were found internally. The figures show that Intel’s internal research also contributed findings, particularly in hardware, rather than establishing that either internal or external work can replace the other.

Reason and duration remain unresolved

The reviewed Intel and Intigriti pages do not state an exact effective date, explain why public bounties are unavailable, or say whether paid rewards will return. Secondary reporting placed the no-bounty programme online by 17 September 2026, but the precise start time has not been confirmed.

Phoronix raised increased AI and large language model-assisted vulnerability reporting as a possible influence. No reviewed Intel statement supports that explanation, so it remains speculation rather than an established reason for the change.

The documented position is therefore limited: public reporting remains available, but the live programme offers no cash bounties. Until Intel explains the transition and reconciles its pages, the permanence of the change, treatment of pending submissions and status of any paid arrangements outside the public programme remain unresolved.

A disclosure channel can support coordinated reporting whether or not it offers a financial reward, so its intake rules merit attention in their own right. The Hack Academy’s online cybersecurity training programme provides a next step through self-paced learning and practical exercises alongside theory, with cybersecurity fundamentals and internet vulnerabilities among its listed subjects.