Apple expands Security Bounty program, top payout rises to $2M

Apple announced a major expansion of its Security Bounty program on Friday, more than doubling top payouts and reshaping how researchers demonstrate exploitability. The company said the top reward for a zero-click exploit chain that achieves remote device compromise will rise from $1 million to $2 million, with the potential to exceed $5 million when additional bonuses for Lockdown Mode bypasses and vulnerabilities in beta software are included. The changes take effect in November 2025.

The upgrades address the most complex attack chains, including those Apple describes as comparable to mercenary spyware used to target specific individuals. Apple noted that such system-level iOS attacks observed in the wild have come from highly sophisticated mercenary spyware, historically associated with state actors, and that new defenses such as Lockdown Mode and Memory Integrity Enforcement have raised the bar for attackers. Apple said the new bounty structure is intended to draw top external security talent to help find and fix vulnerabilities despite those increased defenses.

Beyond the $2 million top award, Apple significantly increased payouts across several categories. Rewards for...