While it's fairly quiet, security professionals should be out looking for bugs - before others find them.