Apple Doubles Bug Bounty to $2 Million to Tackle Advanced Cybersecurity Threats

Apple is strengthening its commitment to cybersecurity by overhauling its Security Bounty programme this November, offering some of the highest rewards in the tech industry to encourage research into critical vulnerabilities.

The tech giant has doubled its top payout from $1 million to $2 million for researchers who uncover exploit chains capable of replicating mercenary spyware-level attacks, particularly those that require no user interaction.

In exceptional cases, Apple said total payouts could exceed $5 million, particularly for discoveries involving:

• Bugs in beta software, or

• Bypasses of Lockdown Mode, Apple’s advanced security feature designed to protect high-risk users from targeted surveillance.

Apple is also boosting rewards across multiple categories to reflect the rising sophistication of cyber threats:

• One-click exploit chains, which need minimal user interaction, now qualify for up to $1 million, up from $250,000.

• Attacks requiring physical proximity to a device can also earn up to $1 million, up from $250,000.

• Attacks involving physical access to locked devices carry a new maximum reward of $500,000, doubled from $250,000.

• WebContent code execution combined with sandbox escape can now earn up to $300,000.

According to Ivan Krstić, Apple’s VP of Security Engineering and Architecture, the company has awarded over $35 million to more than 800 security researchers since the programme’s launch. While multi-million-dollar payouts remain rare, Apple has confirmed issuing several $500,000 rewards for major security breakthroughs.

Apple noted that the only system-level iOS attacks detected “in the wild” have come from mercenary spyware, typically used by state actors to target individuals. To counter such threats, Apple has introduced new safeguards like Lockdown Mode and Memory Integrity Enforcement, which aim to make these attacks far more difficult to execute.

The company said the revamped bounty structure is designed to drive deeper vulnerability research into its most critical attack surfaces, even as discovering such flaws becomes increasingly challenging.

Apple added that the updates form part of its broader commitment to proactive security, transparency, and collaboration with the global cybersecurity community.