Fuzzing is really helpful. Even trying really hard to check for buffer overflow, it's nearly impossible to catch it all.

Kudos for the AFL creator http://lcamtuf.coredump.cx/afl/

I would love if it was easier to do "external checks" (for example network fuzzing). Something like a dissociation of the "submit payload" and the "tortured piece of software" would be really really nice.