Fuzzing is a simple technique for finding software defects that are security interesting. Industrial fuzzing is simply doing ordinary fuzzing scaled out to many cores. Fuzzing's simplicity comes at a cost: it's very slow with a typical industrial camapign running for many months and involving hundreds of millions of fuzz tests. This is not surprising since fuzzing really is just a form of stochastic search. The question is can we make fuzzing an "optimal" search for defects using mathematical theories of "optimal stochastic control" and "reinforcement learning"? In this talk I will give a simple explanation of these ideas and how we've employed them in the ACSC's industrial fuzzer "Sanity". I will talk about using modelling and simulation as a useful tool as well as the much under appreciated area of mathematics of "Multi Armed Bandit Theory". I will talk about our experimental trials on Sanity and what we've learned about "optimal fuzzing". My aim is to make a fun and interesting talk about how maths and science can be applied to cyber-security problems.