Ha, that's a fair point — vulnerability scanners are a whole separate category I haven't tackled yet. BotCost is specifically focused on AI training and search crawlers right now (GPTBot, ClaudeBot, Bytespider etc.) rather than security scanners.

Good news: 0% AI bot traffic on an unadvertised landing page makes sense — those bots tend to follow links and sitemaps. If you run it on a site with real content and traffic you'll likely see a different picture.

Vulnerability scanners on the other hand... that's a different problem worth solving too.