On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the zombie computers would be reprogrammed to look for the new flaw. If a server is not updated immediately when an exploit for a particular software that the server is running is discovered, then it will be susceptible to an attack.
Monitoring and tracking malicious activities and actively blocking them takes time and effort and may consume more resources than just issuing a 403 or a 404 error. How does one decide if a certain scanning pattern is cause for concern to warrant taking pre-emptive measures such as totally blocking them?