Ask HN: How do security researchers know where to look for vulnerabilites?

Also, in a relatively open ended project, llike Google Zero, how do people there decide upon a course of research?