Ask HN: How do security researchers know where to look for vulnerabilites?

Also, in a relatively open ended project, llike Google Zero, how do people there decide upon a course of research?

from Hacker News: Front Page https://ift.tt/2GYMVR9
via