Four Strategies for Security Experts to identify Their Exploitable Attack Surface