Avast's endpoint decision is easiest to test at the boundary between a device, its network and the names it resolves. Product labels such as web protection or network inspection are not proof by themselves. The useful record identifies the network and devices observed, the DNS path selected by policy, the web connections blocked or excluded, and the rescan or status check that shows whether the intended state actually took effect.

DNS state is part of endpoint state

Avast Business documentation for Real Site describes the component as Secure DNS protection against DNS hijacking. It explains that Real Site can route DNS traffic through Avast DNS servers, supports encrypted DNS, uses UDP ports 443 and 53 with TCP fallback, and can apply different protection levels to trusted and untrusted networks. It also documents exclusions and per-device policy overrides.

Those details create an observable network state. A policy may say that Secure DNS is enabled, while a firewall blocks the required traffic, an endpoint override disables the component, or an exclusion sends a domain back to the device's ordinary DNS settings. The accepted result therefore needs more than a toggle. It needs the policy, network classification, endpoint override state, relevant exclusions and a verification from the device.

A name-to-address decision needs a traceable boundary

DNS protection changes how a browser reaches a named service. The record should state which resolver path is intended, when that path changed and who authorised any exception. It should not claim that a secure resolver proves the legitimacy of every site or eliminates every endpoint risk. It proves a narrower fact: the configured endpoint used the documented DNS control for the tested query at the tested time.

For operational continuity, administrators also need a reversal plan. If a resolver path or firewall rule disrupts access, the operator should be able to identify the policy change, restore the previous state and verify normal name resolution without silently leaving a broad exclusion behind.

Network Inspector produces a local inventory, not a universal registry

Avast's Network Inspector documentation says the feature scans the current local network, displays connected devices, can monitor for newly joined devices and can rescan after issues are addressed. It also states important limits: a network connection is required, some information is unavailable without internet access, VPN use can make data inconsistent, and the feature is aimed at small home networks rather than domain networks.

These constraints prevent a scan result from being treated as sovereign truth. The output is a time-bounded observation from one endpoint. A useful ledger records the network under test, the observing device, scan time, devices found, issues reported and the post-remediation rescan. Where a device identity matters, the operator should reconcile the scan with router, inventory or other authoritative records rather than assuming a friendly name is unique.

Web decisions need exclusions and outcomes in the record

Avast's Web Shield documentation describes scanning web and HTTPS traffic, blocking malicious connections or downloads, configurable actions, URL and process exclusions, and report files. It also notes operational conflicts and performance or compatibility effects in some configurations. These are running-code constraints, not edge details.

When a connection is blocked, the evidence should preserve the destination, policy, action and time. When an exclusion is added, it should retain the owner, reason, scope and expiry or review date. A blocked count without those fields is not enough to distinguish a useful control from a recurring false positive, a stale exception or an application that no longer works.

The acceptance test

  • confirm the endpoint inherited the intended Real Site and Web Shield policy;
  • record trusted or untrusted network classification and any local override;
  • test the intended DNS path and preserve the result without recording sensitive query data unnecessarily;
  • run Network Inspector from an identified device and retain scan time and network scope;
  • after remediation, rescan rather than closing an issue from intent;
  • review DNS, URL and process exclusions as operational changes;
  • retain a rollback test for resolver, firewall or web-control changes.

Verdict

Avast is tested by whether endpoint DNS, network discovery and web-control decisions remain accurate, bounded and reversible. Real Site, Network Inspector and Web Shield expose useful control surfaces, but their legitimacy comes from observed resolver paths, device records, explicit exceptions and successful post-change tests. The reality layer is the running endpoint and network record, not a claim that a product setting settles every security question.

Sources

  1. Avast Business: Real Site
  2. Avast Business: Network Inspector
  3. Avast Business: Web Shield