Why a Single Accuracy Score Can't Measure Bot Detection's Real Cost

Bot detection systems that report high overall accuracy can still cause significant harm by wrongly blocking legitimate users, a problem known as false positives. The consequences vary sharply by route — a blocked checkout interrupts revenue, while a failed password reset locks out a real customer. Because most traffic on consumer-facing apps is legitimate, a detector can appear 99.7% accurate while still mishandling thousands of genuine requests daily. Experts recommend evaluating three separate metrics — precision, recall, and false-positive rate — rather than relying on a single aggregate score. Different enforcement actions such as hard blocks, challenges, and monitoring should each be governed by different thresholds based on the cost of each type of error.