Apple ups the reward for finding major exploits to $2 million

Apple has raised its bug bounty to a maximum of $2 million for a chain of software exploits that could be abused for spyware, announced at the Hexacon offensive security conference in Paris by Ivan Krstić, Apple’s vice president of security engineering and architecture, and reported by WIRED. In a further boost, the company says the overall maximum award for such exploits can reach as much as $5 million when including bonus Structure items for bypassing Lockdown Mode or discoveries made while software is in beta.

Apple notes the changes follow years of notable payouts, with past top rewards of $200,000 in 2016 and $1 million in 2019, and it says more than $35 million has been awarded to over 800 researchers since opening the programme to the public in 2020. The bug bounty now covers additional categories, including one-click WebKit browser exploits and wireless proximity exploits, and introduces a “Target Flags” offering to test researchers’ capabilities in real-world scenarios. According to WIRED, Apple also points to the scale of its ecosystem, with more than 2.35 billion devices active worldwide.