Having briefly interacted with a few of them, and following their work in general: 1. They have a phenomenal intuition for where developers get lazy, tired or

Having briefly interacted with a few of them, and following their work in general: 1. They have a phenomenal intuition for where developers get lazy, tired or simply incompetent in security-sensitive code, 2. They have, in aggregate, a vast knowledge and understanding of past vulnerabilities and how those might be repeated elsewhere or imperfectly patched, 3. They practice a lot and they read a lot (i.e. relevant research, etc). It might be more accurate to say that they have a lot of practice because of their work, not that they actively practice outside of work. 4. They are good at the general process of security research - long hours of mostly dull, complex research interspersed with brief eureka moments and bouts of euphoria. They're an extraordinary team, for sure.