Dunno what he does now, but he worked quite a bit in static analysis, which does a much better job at discovering nasty code properties than tests do. He found

Dunno what he does now, but he worked quite a bit in static analysis, which does a much better job at discovering nasty code properties than tests do. He found issues in code you most likely rely on, like the Linux kernel : https://linux.kernel.narkive.com/Cw4EtIti/coverity-untrusted-user-data-in-kernel https://linux.kernel.narkive.com/Cw4EtIti/coverity-untrusted..., and also the pretty important CVE-2010-5298 in OpenSSL.