>... is a lot like good science. You start with a firm understanding of the system, form a hypothesis about what could be wrong with it, test your hypothesis, and then repeat. The stronger your initial understanding of the system, the faster you can debug things.

>They're the best because they can clearly visualize the system, how data is flowing through it, and where potential problems might arise

This also applies very well to appsec/vulnerability finding.