AV-TEST Evaluates Secure Web Gateway and DNS-Layer Security Efficacy

The lab test assessed each secure web gateway vendor’s ability to protect roaming and remote workers. Given that the global pandemic has accelerated the move of edge security controls to a cloud-delivered model, each of the vendors’ offerings was configured with the protection of their roaming agents. A separate test for DNS-layer protection was also performed.

In order to ensure a fair review, the sponsor did not supply any samples (such as malicious or clean samples, URLs or associated metadata) and did not influence or have any prior knowledge of the samples tested or the testing methodology. All products were configured to provide the highest level of protection, utilizing all security-related features available at the time.

The test focused on the detection rate of links pointing directly to portable executables (PEs) malware (e.g., EXE files), links pointing to other forms of malicious files (e.g., HTML, JavaScript) as well as phishing URLs. A total of 3,572 malicious samples were tested. All links and malicious samples tested were verified by AV-TEST as recent and active.

In addition, AV-TEST evaluated false positive ratings for each vendor. AV-TEST assessed downloads for well-known applications from HTTP and HTTPS websites. An additional false positive test was performed against known clean popular websites from Alexa’s top list. A total of 2,165 clean websites and downloads were used.

In the first part of the study, secure web gateway solutions were tested. A secure web gateway is based on a full web proxy that sees and inspects all web connections. Unlike DNS-layer protection which only analyzes domain names and IP addresses, a web proxy sees and inspects all files and the full URLs, enabling more granular inspection and control.

Download Report (PDF)