Interviews reveal a slow start for Apple's bug bounty program as some feel financial rewards are too small or reporting bugs would prevent research
Lorenzo Franceschi-Bicchierai / Motherboard :
Context & Ripple Effects
Apple opened its bug bounty in August 2016 as an invitation-only program aimed at high-quality exploits in iOS and iCloud, with analysts calling it a good start that would grow over time (the program's launch coverage framed it exactly that way). A year on, Motherboard's interviews find the take-up has been slow.
The two complaints researchers give are concrete: the financial rewards look too small relative to what a working exploit can earn elsewhere, and reporting a bug to Apple effectively ends the researcher's ability to keep studying it. The same frictions resurface years later — researchers still describing payment confusion and long fix delays (Washington Post reporting in 2021) — before Apple eventually disclosed roughly $20M in cumulative awards.
First-order effects
- Security researchers weighing a submission face a direct trade-off between Apple's payout and the resale or research value of the exploit, so Apple receives fewer advance reports on iOS and iCloud flaws than its installed base would justify.
- The researchers who do engage are limited to Apple's invited set, leaving the program's scope dependent on Apple's own judgment of who counts as a credible finder.
Second-order effects
- Exploit brokers and gray-market buyers become the default counterparty for flaws Apple underprices, which raises the clearing price Apple must pay to compete for the same vulnerabilities.
- Rival platform vendors running open bounty programs gain a recruiting argument for researchers deciding where to spend their time, pressuring Apple toward higher rewards and broader eligibility.
Third-order effects
- If the pattern holds, vulnerability markets split by platform: closed, invitation-based programs like Apple's concentrate on a vetted few while open programs absorb the broader market — a structure the later coverage of payment disputes and delayed fixes suggests was slow to change.
- Sustained researcher dissatisfaction pushes vendors toward publishing aggregate payout figures as proof of program health, the move Apple itself made when it cited ~$20M awarded including twenty $100K+ rewards.
The trend: Platform vendors' bug bounty programs are converging from invitation-only experiments into tiered, market-priced systems, with Apple's slow start showing how payout size and researcher economics gate participation.