Apple has introduced a major update to its Security Bounty Program, set to take effect in November, offering some of the highest payouts in the industry. The company has doubled its maximum reward from $1 million to $2 million for identifying exploit chains capable of executing spyware-like attacks without user interaction.
According to Apple, rewards could reach up to $5 million for uncovering even more critical vulnerabilities, such as flaws in beta software or bypasses of Lockdown Mode, a key security feature in Safari.
The company also increased the reward for user-interaction exploits (one-click attacks) to $1 million, while attacks requiring physical proximity to devices now earn the same amount. Physical access exploits on locked devices can earn researchers $500,000.
Ivan Krstić, Apple’s Head of Security Engineering and Architecture, told Wired that Apple has paid over $35 million to more than 800 security researchers since the program’s expansion, noting that the highest rewards remain rare but significant.
Apple emphasized that most real-world iOS attacks so far have originated from mercenary spyware used by state-linked entities to target individuals.
With this update, Apple aims to encourage advanced cybersecurity research and make finding high-level vulnerabilities more challenging, especially with features like Lockdown Mode and Memory Integrity Enforcement strengthening system defenses.
