I generally understand the technical premise of exploits and running arbitrary code, but I am genuinely curious how one searches for exploits in a system like t

I generally understand the technical premise of exploits and running arbitrary code, but I am genuinely curious how one searches for exploits in a system like this. Throwing known exploits at new APIs and see what happens? Or is it more subtle?