Testing the Hypothesis
Ideally, find a formal derivation of primitives
Experimentally, test all the vulnerabilities you can find on as many systems as possible
First is better but more difficult; second is vital because it captures the way most sites, systems treat security