angr is cool and all (disclaimer: I know many of the people who work on it) but we’re not really at a point where you can just point automated tooling at software and get results. That isn’t to say that code analysis tools are not heavily used by people finding exploits, but their effectiveness is limited by the difficulties of analyzing code and the fact that the “good guys” have access to pretty much the same tooling. (In fact, their tooling is better in a sense because it often runs in better conditions like with full source code and lack of a need to find a full exploit for every bug.)