Apple is accepting applications for its Security Research Device Program until October 30, 2026, leaving prospective candidates only days to assemble a submission. The scheme hands selected researchers a specially fused loaner iPhone running a custom firmware build, one that strips back enough of Apple’s usual restrictions to let them inspect the operating system from the inside instead of working around its defenses. Only a limited number of the handsets are issued each year.
- Key Point: The Security Research Device is a fused iPhone with a research firmware build that permits shell access, lets researchers pick their own entitlements, run any tools and modify the kernel.
- Key Point: Every iOS and iPhone component is open to study; only Apple Pay and third-party applications are carved out.
- Key Point: Each unit is a 12-month renewable loan that stays Apple property and must remain on approved premises with access limited to named personnel.
- Key Point: Vulnerabilities found on the devices are automatically considered for Apple Security Bounty awards, including bonuses tied to preview and beta software.
What the fused build lets researchers reach
Recipients can examine iOS components directly — the kernel, shell access and entitlements all sit within reach — and they are free to run whatever tools they choose, up to and including modifications to the kernel itself. Apple Pay and third-party applications are outside the scope; the rest of the platform is not. Participants additionally gain software previews, entry to security beta projects, a dedicated research community and special tooling.
The program rests on an awkward premise that Apple itself acknowledges. Its flagship handset is, by the company’s account, the most secure phone sold to consumers, and that strength makes the internals hard to study even for seasoned researchers. Before this channel existed, anyone who wanted to understand iOS had to decompile it themselves or work from builds that leaked, and both routes meant first defeating the protections Apple markets as a feature.
Ownership, eligibility and the terms of the loan
The phone never changes hands permanently. It is issued for 12 months, renewable, and remains Apple’s property for the whole period. Researchers must keep it on the premises at all times, restrict access to authorized staff and treat it as equipment for controlled testing rather than a daily driver.
Applicants must demonstrate a history of uncovering flaws, whether in Apple’s own software or in other modern operating systems. They also need to live in an eligible country, be of legal age and not have been employed by Apple at any point in the preceding year. Organizations applying on a team’s behalf must authorize the request and name every individual who will need access to the device. Filing an application requires signing in with an Apple Account.
Bounty payments and a more formal pipeline
Anything discovered with an SRD is automatically put forward for the Apple Security Bounty, and findings in preview or beta software can attract extra bonus awards. Crucially for participants, reporting a flaw does not cost them their continued access to iOS internals, which removes an incentive to sit on findings.
The arrangement marks a change in how Apple handles vulnerability disclosure. Rather than waiting for researchers to stumble onto bugs on their own, the company now runs a structured route for systematic iOS testing. That could surface problems years earlier than independent discovery would, and it gives Apple a steadier stream of reports from people who already know where to look. If the model proves workable, rival platform owners may adopt similar schemes, reshaping how mobile security research is done across the industry.
What the deadline means for researchers
With the window closing on October 30, the practical question for security teams is whether an existing body of work clears the eligibility bar in time. Because the number of devices is capped each year, early submissions may carry an advantage over later ones. Anyone holding unreported vulnerabilities in Apple’s platform has to weigh a fresh application against the faster route the bounty program offers. For Apple, the deadline closes one cycle and opens the next; the measure of the effort will be whether the reports it generates arrive ahead of attackers working the same ground.