Google's Generative AI report in Search Console, nearly two years in the making, delivers impressions only — no click data, no query-level detail. Visibility is what publishers get, and for an industry that spent two years waiting to quantify AI-driven traffic loss, that is a thin result. A new analysis argues the report is "almost useful" — but only once you layer commercial data, traffic dependency and, optionally, server logs on top of it.

What the report actually measures

Google's John Mueller has clarified how impressions are counted: "The impressions are based on links to your site being shown in AI Overviews / AI Mode... a link shown directly can count, while a link that requires activation only counts after that activation." In other words, a link visible in the AI answer counts immediately; a link hidden behind an expansion counts only once the user expands it.

That is first-party visibility data from arguably the most-used AI interface in the world, which has real value. But it is not exposure, risk or value. The report shows no clicks — because AI features largely don't send them — and no query-level breakdown. Calculating actual business exposure requires joining the GSC data with external sources.

From visibility to exposure: the core model

The proposed framework starts with the Generative AI report's sitewide AI impressions and the page-level export. One practical constraint: the Pages export caps at 1,000 rows, so for larger sites it represents a sample, not a census. Analysts are advised to classify URLs by subfolder — /news/, /sport/, /business/, /lifestyle/ — or export at subfolder level across multiple properties to get fuller coverage.

That page-level view answers four questions: share (where AI visibility is concentrated), representation (which sections and URLs appear), intensity (whether visibility is spread evenly or concentrated among a handful of performant pages) and coverage (how much of Google's reported total the export actually represents).

Step three adds commercial data from GA4 or an equivalent platform. The recommendation is deliberately simple: pick one primary KPI — revenue, subscriptions, conversions, leads — and apply it consistently across every subfolder. Secondary metrics can support context, but the primary measure of commercial value should not change.

The payoff is immediate. In one worked example, a Business section shows high AI visibility but also higher revenue; Technology has comparable visibility with significantly less revenue; Sport has very low visibility but a larger share of revenue. Visibility alone would have ranked these sections incorrectly for business impact.

The exposure formula

The final input is traffic dependency: the share of total sessions each section gets from organic search. A section drawing 10% of its traffic from Google is lower risk than one drawing 90%, particularly if the rest is direct or branded.

The model normalizes four inputs — AI Visibility (V), optional AI Substitution (S), Traffic Dependency (T) and Commercial Value (C) — to a 0-100 scale and combines them:

AI Commercial Exposure = (V × S × T × C)^(1/4)

Without reliable AI Overview prevalence data, the Core model drops substitution: (V × T × C)^(1/3). Importantly, the analyst stresses that leaving S blank is not the same as entering zero — zero means you measured substitution and found none; blank means you didn't measure it.

The geometric mean prevents a common misread: huge AI visibility alone cannot produce a huge exposure score if the content has almost no commercial value, and high-value content is not automatically high risk if it has little AI visibility or limited search dependence.

Substitution data and server logs

AI Substitution requires third-party SERP data — the analysis names DataForSEO as one option — checking whether important queries trigger AI Overviews. Using the top 100 or 1,000 GSC queries per site or section is a reasonable starting universe. The author is explicit about the limitation: this shows exposure in the current SERP, not proof that AI actually substituted a click, which would require user testing panels.

Server logs add an optional layer of granularity: AI crawler access, crawl frequency, which sections and URLs are being accessed, and — increasingly important — which type of crawler is making the request. Rather than lumping everything into "AI traffic," activity can be split into training bots, search bots and retrieval bots, producing a rough AI demand signal.

One caveat the analysis flags clearly: logs only prove access. A training bot requesting a URL does not prove the content trained a model. The defensible claim is narrower: "This content is attracting AI crawler activity consistent with training, search and/or retrieval access."

Resilience and opportunity

Exposure is not the whole picture. Two sections with identical exposure scores can face very different risk levels — a live sports statistics site, for instance, has reason to watch features like Google's Live NFL Game Feed. Resilience is scored as:

AI Resilience = (Branded Search + Direct Audience + Returning Audience + Content Defensibility) ÷ 4

The first three components are percentages; content defensibility is a 0-100 qualitative score based on uniqueness, effort, expertise, proprietary information and access.

The same server-log data can also flag opportunity. High-value proprietary content being hammered by retrieval crawlers could represent an opportunity, a liability, or both — information worth having before making decisions on bot blocking, licensing, partnerships or AI distribution. Crawler activity alone does not make content valuable, and it does not guarantee an AI company will pay for it. But mapped against visibility, commercial value and defensibility, it points to where AI threatens the existing business and where a new market for existing content value might be forming.

The full framework is available as a Google Sheets diagnostic covering visibility analysis by subfolder, Core and Enhanced exposure models, resilience scoring, optional opportunity analysis and a final scorecard. The Enhanced model requires the server-log analysis to be run beforehand, aggregated by subfolder and bot type.

What to watch next: whether Google adds click or query-level data to the Generative AI report, and how crawler-classified log data evolves as licensing negotiations between publishers and AI companies develop.