Advancement of Exploit Mitigations, which awarded over $260,000 in prizes to researchers at BlackHat USA 2012. The grand prize of $200,000 was at the time the largest cash payout being offered by a software vendor. She also created Microsoft's first bug bounty program, which paid over $253,000 and received 18 vulnerabilities over the course of her tenure. ISO vulnerability disclosure standard Moussouris has helped edit the ISO/IEC 29147 document since around 2008. In April 2016, ISO made the standard freely available at no charge after a request from Moussouris and the CERT Coordination Center's Art Manion. HackerOne In May 2014, Moussouris was named the Chief Policy Officer at HackerOne, a vulnerability disclosure company based in San Francisco, California. In this role, Moussouris was responsible for the company's vulnerability disclosure philosophy, and worked to promote and legitimize security research among organizations, legislators and policy makers. "Hack the ..." series While still at Microsoft, Moussouris began discussing a bug bounty program with the federal government; she continued these talks when she moved to HackerOne. In March 2016, Moussouris was directly involved in creating the Department of Defense's "Hack the Pentagon" pilot program, organized and vetted by HackerOne. It was the first bug bounty program in the history of the US federal government. Moussouris followed up the Pentagon program with "Hack the Air Force". HackerOne and Luta Security are partnering to deliver up to 20 bug bounty challenges over three years to the Defense Department. Luta Security In April 2016, Moussouris founded Luta Security, a consultancy to help organizations and governments work collaboratively with hackers through bug bounty programs. New America fellow During 2015-2016 and 2016-2017, Katie Moussouris served as a Cybersecurity Fellow at New America, a U.S.-based think tank. Wassenaar Arrangement amendment In 2013, the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies was amended to include "intrusion software". Moussouris wrote an op-ed in Wired criticizing the move as harmful to the vulnerability disclosure industry due to the overly-broad definition and encouraged security experts to write in to help regulators understand how to make the right changes. She was invited as a technical expert to directly assist in the US Wassenaar Arrangement negotiations, and helped rewrite the amendment to adopt end-use decontrol exemptions based on the intent of the user. Exploit labor market research Moussouris was a visiting scholar at the MIT Sloan School of Management and