The point is the scanner keeps track of versions: 148.65.45.123 is using SSH x.y. When a zero-day hits for a particular version, they are able to look at the li

The point is the scanner keeps track of versions: 148.65.45.123 is using SSH x.y. When a zero-day hits for a particular version, they are able to look at the list previously generated to see immediately where they can put a back door. If you don't advertise your ssh (eg change ports) or your version, you aren't on that zero day list. Your system isn't more secure, but your are less likely to be hacked. So, that's the scenario. The above has reduced your chances of being hacked without actually increasing how secure your systems actually are. And then the question: how do you account for that in assessing the cost/value benefits associated with security? I really am curious about this, because there is a cost to the above, so any value should be included in the calculation of whether it is worth it. How do you calculate the value of not being on that list?