What years of breaking systems teaches you about building them.
The biggest shift: attackers don't need to be clever if a system gives them an easy path. Most real findings weren't exotic zero-days — they were a missed access check or an overly trusted assumption.