ERP Roundup: Microsoft Rewrites Its Dynamics Bounty, 86% Report AI Incidents, and Panaya Bets on Autonomous Testing

1. Microsoft rewrites the Dynamics 365 bounty, and Business Central is in scope

Microsoft's Dynamics 365 and Power Platform Bounty Program page was updated on 14 September with restructured award categories. Awards now run from $1,250 to $60,000. A separate AI bounty table pays $12,000 to $30,000 for critical-severity findings depending on report quality, and $6,000 to $20,000 for important ones. High-Impact Scenario multipliers add 100% for critical cross-tenant vulnerabilities, 50% for important ones, and 20% each for Power Platform escalation of privilege in Dataverse and Dataverse plugin sandbox escapes.

Business Central is named explicitly in the in-scope list, alongside Sales, Customer Service, Finance, Supply Chain Management and the Power Platform products. MSDynamicsWorld reported the change on 17 September.

2. 86% report an AI incident, and 28% report agents acting without approval

OneTrust published its 2026 AI-Ready Governance Report on 14 September, based on a Sapio Research survey of 1,200 senior business decision-makers across the US, Canada, the UK, France, Germany, Spain, Australia and Singapore. The headline numbers: 87% of organisations encourage employees to use AI agents, but only 47% say they have clear governance, oversight and controls. 86% report at least one AI-related incident in the past year, and 28% report two or more incidents in which an AI system took an action nobody had approved.

The response is the interesting part. Only 27% slowed or paused deployment; 49% increased training instead. A third said employees used unapproved AI because approval was too slow. OneTrust's chief innovation officer Blake Brannon frames it as a timing problem: governance "has always relied on knowing in advance what a system will do", while AI requires deciding in the moment. These are survey responses, not audited incident counts, and OneTrust sells governance software.

3. Panaya rebuilds its pitch around autonomous testing

Panaya launched a new website, identity and message on 15 September, built around the line "Test What Matters" and a positioning it calls autonomous enterprise testing, as reported by ERP News. The centrepiece is Seemore, an agentic layer the company describes as acting across change impact analysis, testing and code correction. Panaya says more than 3,500 organisations, a third of the Fortune 500 among them, have used its technology since 2006. CMO Moranne Yaari sums the strategy up as understanding impact before acting and focusing effort where risk is greatest.

Two things are worth noting as claims rather than findings. The efficiency figures on Panaya's own site, including a 90% cut in regression effort, are vendor marketing and not independently verified here. And the platforms named on that homepage are SAP, Oracle and Salesforce, with Workday and ServiceNow mentioned alongside. Dynamics is not on the list.

4. Copilot Business gets a meter switched on by default

Microsoft told CSP partners on 16 September that from 2 November 2026, new Microsoft 365 Copilot Business licences bought through CSP will have usage-based billing on by default, with a preset monthly limit and the Azure subscription pre-configured. New purchases only, not existing licences. Microsoft frames it as removing setup friction; the effect is that a consumption meter runs unless somebody changes it.