It is Persistence
published: February 25th, 2009
Do some people have the magical skill to find vulnerabilities with ease while others don’t! Of course not! I disagree with the whole tendency to believe that technical understandings is all that is needed to find vulnerabilities.
It is mostly persistence that plays a role. Most of the researchers I know have almost zero knowledge on the subjects they dive into. The knowledge builds up with the time and by being more persistent on the topic of exploration regardless of its difficulty level.
Simply put, the more time you spend on something, the higher the chances to find oddities. It sound quite logical, don’t you think? Countless of examples already exist to prove my point.
triggerzdown 
I disagree. There is:
Testing
Inspection
Testing has Dynamic analysis, white-box testing (full knowledge), black-box testing, gray-box testing (see: OSSTMM 3.0 for more details), experience-based testing (which you speak against), and defect-driven testing (which Gareth Hayes has mastered with XSS and which Bernardo Damele A. G.has mastered with SQLi – and which Shreeraj Shah has mastered with basically everything else).
Inspection has static analysis + another called “review”.
Your “Persistence” is really something else called “Completeness” in my eyes. I also feel that experienced-based testing is the most important, which is why tools fail us (imagine imperfect software failing at testing imperfect software!). I have found bugs just by looking at a web page and saying “that’s a bug!” that nobody else would ever see. Ask the tssci-security team + others that I probably can’t and shouldn’t name.
So for you to dismiss experience-based testing seems to demonstrate (to me) that you don’t have enough experience. This isn’t a knock, but defect-driven approaches and focusing too much on other areas (which you are clearly highly intelligent about) may blind you to the overall “big picture” stuff.
Curphey wrote an article about the Security Gene, so this was already discussed (and I think at the time, I didn’t agree with either of you), but it’s an interesting conversation topic. Thanks.