Finding the Security Holes before the Hackers Do