Apple is accepting applications for its Security Research Device program through October 30, 2026, offering approved researchers specially configured iPhones designed for investigation of iOS vulnerabilities. The devices provide access that ordinary consumer iPhones deliberately restrict, allowing researchers to examine deeper layers of the operating system without first defeating its standard protections.
A Security Research Device, or SRD, is a specially fused iPhone that supports shell access, custom entitlements and kernel customization. Participants also receive access to software previews, security beta projects, specialized research tooling and a community of other approved researchers. Apple presents the program as a way to lower the practical barriers facing both established and newer iOS security specialists.
Research may cover iOS and iPhone components, with two explicit exclusions: Apple Pay and third-party applications. Vulnerabilities found through SRD work are automatically considered for the Apple Security Bounty program. Findings involving preview or beta software can also qualify for bonus awards under the bounty rules. Eligibility for consideration does not itself guarantee a payment, because reports still undergo Apple's review.
The hardware is not a giveaway or an everyday phone. Apple supplies each approved device as a 12-month renewable loan and retains ownership. It must remain on the participant's premises, may not be used as a personal daily device and can be accessed only by people whom Apple has authorized. The company says only a limited number of devices are available each year, so submitting an application does not ensure acceptance.
Program rules also impose disclosure responsibilities. If a participant uses the SRD at any stage to find, test, validate or confirm a vulnerability, that issue must be reported promptly to Apple. When a bug affects third-party code, the researcher must also report it to the relevant third party. Apple separately invites reports for vulnerabilities discovered without the research device.
Those restrictions distinguish the program from ordinary consumer-device modification. Apple supplies deeper access deliberately within a controlled agreement, and participants use a defined disclosure channel rather than treating the research phone as unrestricted personal hardware.
Applications require an Apple Account. Companies, universities and other organizations may apply through a representative authorized to act for them, and must identify every person who will need device access. Each approved user must acknowledge the program responsibilities.
The SRD model gives researchers unusually broad control while preserving a controlled environment and clear handling rules. For Apple, the arrangement channels deeper technical scrutiny into a formal disclosure and bounty process. For researchers, it removes the preliminary task of bypassing iPhone protections before substantive operating-system analysis can begin.
