Is it easier to discover a vulnerability than to introduce one?