Updated August 14, 2026
What independent testers actually measured
What independent test data exists for these VPNs?
One laboratory test covering providers we review has been published with its full method and sample size: AV-TEST measured malicious-URL blocking in September–October 2024 across five VPNs. NordVPN blocked 83.42% of 3,209 samples; Proton VPN blocked 4.43%. The test was commissioned by NordVPN’s parent company, which you should weigh.
Every result on this page was produced by somebody else. We have run no tests of our own, and the honest response to that is to report other people’s properly — with the tester, the date, the sample size and, above all, who paid for it — rather than to invent some.
The results
| Provider | Result | Against the field | Funded by |
|---|---|---|---|
| Proton VPN | 4.43% of malicious URLs blocked. By category: 4.38% executable-malware URLs, 3.30% other malicious files, 5.50% phishing. False positives 0.74%. | Fourth of five. NordVPN led at 83.42%. Read this as a scope difference rather than a defect: Proton’s NetShield is built to block ads, trackers and known-malicious domains, not to act as an antivirus, and it was measured against a feature designed to do the latter. | NordSec, a competitor’s parent company |
| NordVPN | 83.42% of malicious URLs blocked. By category: 88.10% executable-malware URLs, 84.38% other malicious files, 78.19% phishing. False positives 0.48%. | Highest of the five tested. The next best, IPVanish, reached 46.96%; ExpressVPN, Mullvad and Proton VPN all scored under 5%. | NordSec, NordVPN’s parent company |
How to read that table
Three things about it matter more than the numbers. First, the test was commissioned by NordSec — NordVPN’s own parent company — and NordVPN won by a factor of nearly eighteen over the next-nearest provider we cover. That is exactly the shape a bought result takes, and it would be dishonest to print the number without printing that.
Second, it is nonetheless real data. AV-TEST states that NordSec supplied no samples, had no advance sight of them, and had no influence over selection; all 3,209 malicious samples were sourced and pre-verified by AV-TEST at its Magdeburg laboratory. A commissioned test with sample-selection controls is a different thing from a vendor’s own marketing chart.
Third, and most misread: it measures an add-on, not the VPN. NordVPN’s Threat Protection Pro is an antivirus-grade URL blocker. Proton’s NetShield blocks ads, trackers and known-malicious domains. Measuring the second against a benchmark designed for the first produces 4.43%, and that number says almost nothing about Proton VPN as a VPN — whose no-logs infrastructure has passed five consecutive audits.
The useful conclusion is narrow: if you want a VPN that also blocks malware URLs aggressively, one of these four is measurably better at it. That is all it establishes.
Providers with no qualifying test data
PureVPN and FastestVPN have no third-party laboratory result we could find that publishes its method and sample size. Plenty of sites publish speed figures for them; none we found state the client hardware, the baseline line speed and the run count.
An empty row is information. It means nobody with a published method has tested that provider, which is worth knowing before trusting a figure you find elsewhere.
What we would need to add a result here
- A named testing organisation, not an anonymous “our tests”
- The fieldwork dates, not just a publication date
- The sample size and how samples were selected
- Who funded the test
- A report you can open and read, not a summary of one
Nearly every VPN speed table on the web fails at least three of these. That is why this page is short, and why it will stay short until our own lab has results to add under a method published in advance.
Questions
- What independent test data exists for these VPNs?
- One laboratory test covering providers we review has been published with its full method and sample size: AV-TEST measured malicious-URL blocking in September–October 2024 across five VPNs. NordVPN blocked 83.42% of 3,209 samples; Proton VPN blocked 4.43%. The test was commissioned by NordVPN’s parent company, which you should weigh.
- Why does KotoVPN publish so few test results?
- Because few exist that meet the bar. A published figure is only usable if the report states who ran it, when, on what sample, and who paid. Most VPN speed figures on the web state none of those, and a number without a method is not a measurement — it is a claim wearing a number’s clothes.
- Is a vendor-commissioned test worth anything?
- It is worth something, but less than a self-funded one, and the reader has to be told which it is. In the AV-TEST case the commissioning party was NordSec, NordVPN’s parent, and NordVPN won by a wide margin. AV-TEST states NordSec supplied no samples and had no advance sight of them, which is a meaningful control. Both facts belong next to the result.
- Why did Proton VPN score so low on the AV-TEST malware test?
- Because it was measured against something it does not claim to be. NordVPN’s Threat Protection Pro is built to work as an antivirus-grade URL blocker; Proton’s NetShield blocks ads, trackers and known-malicious domains. On a test designed around the former, the latter scores badly without that meaning Proton is less safe as a VPN. Scope mismatch is the single most common way test data gets misread.