31 October 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Wireless Penetration Testing: What a Wi-Fi Assessment Covers, Why It Matters and How to Scope It
Your wireless network is the one part of the corporate perimeter that extends into the car park, the lobby and the office next door. This guide explains what a wireless penetration test examines, what it tells you about risk, and how to prepare for one, written for CISOs and IT managers scoping the work.
What a wireless penetration test is, and why it still matters in 2026
A wireless penetration test is a hands-on assessment of the radio-based ways into your organisation: corporate Wi-Fi, guest Wi-Fi, the networks that printers, cameras and building systems use, and the short-range technologies around them such as Bluetooth Low Energy and RFID access badges. The question it answers is simple to state. Can someone within radio range, without an account and without walking through the front door, reach data or systems that should only be available to authenticated employees on managed devices?
Many organisations assume the answer is no because they moved to WPA2-Enterprise or WPA3 years ago. In practice the protocol is rarely the weak point. The weaknesses we find are design and configuration decisions: laptops and phones that are allowed to connect without checking whose authentication server they are talking to, legacy EAP methods kept alive for one old scanner, guest networks that can still route to an internal management interface, and a single shared key protecting every printer and camera in the building for six years. None of these show up in an external penetration test, and most of them are invisible to a vulnerability scanner.
Wireless testing is also a regulatory expectation in several frameworks. PCI DSS v4.0.1 Requirement 11.2.1 requires organisations to detect and manage authorised and unauthorised wireless access points at least every three months. NIST SP 800-153 sets out guidance for securing wireless local area networks, and ISO/IEC 27001:2022 Annex A controls 8.20 (networks security) and 8.22 (segregation of networks) are where an auditor will look for evidence that wireless segmentation is designed and verified rather than assumed.
What a wireless assessment covers
A properly scoped wireless test looks at the whole radio surface of a site, not only the corporate SSID. These are the areas we discuss in a scoping conversation.
Enterprise Wi-Fi authentication
How WPA2-Enterprise or WPA3-Enterprise and 802.1X are configured: which EAP methods are allowed, whether clients validate the RADIUS server certificate, and whether a stolen or captured credential would be enough to join the corporate network.
Rogue and look-alike access points
Whether an unauthorised access point plugged into a wall port would go unnoticed, and whether your devices would connect to a look-alike network broadcasting your corporate name. Both are realistic risks in shared buildings and busy public areas.
Guest networks and captive portals
Whether guest Wi-Fi is truly isolated from corporate VLANs, management interfaces and other guests, and whether the captive portal can be bypassed or reveals more about your environment than intended.
IoT, OT and printer networks
Pre-shared-key networks for printers, cameras, meeting-room screens, building management and production equipment: key strength, key age, who knows the key, and what a device on that network can reach.
Bluetooth and BLE
In brief: discoverable devices, pairing behaviour of peripherals and specialised equipment, and BLE-enabled products your organisation builds or deploys. Deeper device work belongs in hardware security testing.
RFID badge systems
Whether the badge technology in use can be read at a distance or cloned, and how that interacts with physical access to network ports and server rooms. Detailed reader and card analysis is scoped as hardware security testing.
Segmentation behind the radio
What an attacker who does get onto a wireless network can reach next. This is where wireless testing meets the internal network test: VLAN separation, firewall rules and network access control decisions.
Coverage and signal leakage
Where your networks can be received from outside the building, such as the street, car park, neighbouring tenants or a lobby, which defines who can realistically attempt any of the above.
Enterprise Wi-Fi authentication: the five decisions that matter most
Most enterprise wireless findings trace back to a handful of design choices. Understanding them makes the report easier to read and the remediation easier to prioritise.
1. Which EAP method you use
EAP-TLS, where every device proves its identity with a certificate, is the strongest common option because there is no reusable password on the wire. Password-based methods such as PEAP with MSCHAPv2 are still widespread and acceptable only when clients are configured strictly. Legacy methods kept for compatibility, often for one old device class, quietly lower the bar for the whole network.
2. Whether clients validate the RADIUS server certificate
This is the single most common serious finding in enterprise Wi-Fi. If laptops or phones do not check that the authentication server presents your certificate, issued by your trusted authority, for your server name, a look-alike network can collect credential material from them. The fix is configuration, deployed centrally through MDM or group policy, not new hardware.
3. How unmanaged and BYOD devices are handled
Personal phones joining the corporate SSID with a username and password are usually the devices that do not validate certificates. Whether they belong on the corporate network at all, or on a separate network with limited reach, is a business decision the test makes visible.
4. WPA3 transition mode and management frame protection
WPA3 makes Protected Management Frames (IEEE 802.11w) mandatory, which removes a class of disruption and downgrade issues. Many networks run in mixed WPA2/WPA3 transition mode for compatibility, which keeps the older behaviour available. The test establishes what is actually negotiated, not what the controller dashboard suggests.
5. Pre-shared-key hygiene for devices that cannot do 802.1X
Printers, sensors and OT equipment often only support a shared key. That is acceptable when the key is long, unique per network, rotated when staff or suppliers leave, and the network it protects can reach only what those devices need. It becomes a material risk when the same key has been on sticky notes and supplier laptops for years.
Wireless assessment vs internal network test vs Wi-Fi survey
These three services are often confused in procurement. They answer different questions and are delivered by different specialists.
| Aspect | Wireless penetration test | Internal network penetration test | Wi-Fi survey by an integrator |
|---|---|---|---|
| Question answered | Can someone in radio range get in, and what can they reach? | What can an attacker with a foothold inside the network reach? | Does the Wi-Fi perform: coverage, capacity, roaming, interference? |
| Starting point | Outside the network, within radio range, no credentials | A device or account already on the internal network | Site plans and access point placement |
| Main focus | Authentication design, client behaviour, rogue APs, guest isolation, PSK networks | Active Directory, segmentation, patching, lateral movement paths | Signal strength, channel planning, throughput |
| Performed by | Offensive security testers | Offensive security testers | Network integrator or vendor engineers |
| On site | Yes, physical presence required | Usually on site or via a provided device or VPN | Yes |
| Output | Security findings with business impact, coverage map, remediation | Security findings, attack paths, remediation | Heatmaps and placement recommendations |
| Compliance relevance | PCI DSS 11.2.1, ISO 27001 A.8.20 and A.8.22, NIS2 risk measures | ISO 27001, NIS2, DORA, PCI DSS 11.4 | Generally none for security |
Physical presence, legal authorisation and rules of engagement
Wireless testing cannot be done remotely. The tester has to be within radio range of your access points and your users, which means on site, typically across one or more business days so that real client devices are present. For multi-site organisations we agree a representative selection of locations, usually headquarters plus sites with a different wireless design or a high concentration of sensitive systems.
Written authorisation is essential. In the Netherlands, accessing a computer system without permission is an offence under article 138ab of the Wetboek van Strafrecht (computervredebreuk), and radio signals do not respect property lines. The engagement letter names the SSIDs, BSSIDs and locations in scope, the testing windows, and explicitly excludes networks belonging to neighbours, landlords or shared-building providers. Where your Wi-Fi is operated by a landlord or managed service provider, their written consent is needed too. Testing that could interrupt service, such as anything that might cause clients to disconnect, is agreed in advance and scheduled outside critical hours, or excluded.
Rules of engagement also cover people. Wireless tests sometimes involve observing how staff devices behave, and in shared spaces visitors will be in range. The test is designed so that only your organisation's devices and networks are assessed, and any incidental third-party data is not retained.
How wireless fits with an internal network test and hardware testing
A wireless test answers how an attacker gets in. An internal network penetration test answers what happens next. The two are most valuable together: if the wireless test shows that a guest or IoT network can reach an internal subnet, the internal test shows whether that subnet leads to domain administrator rights, file shares or production systems. Scoping them as one engagement avoids paying twice for the same on-site days and produces a single, connected attack narrative for the board.
Bluetooth, BLE and RFID are covered at the level of exposure in a wireless assessment. When the concern is a specific device, for example a product your company ships, a door controller or a badge reader, that work is better scoped as hardware security testing, where the device itself is examined in a lab.
What a good wireless penetration test report contains
A wireless report should be usable by your network team on Monday morning and readable by your CISO in the steering committee. Ask for these elements.
- An executive summary that states in business terms whether an outsider in range could reach internal data or systems, and from where
- A coverage map showing where each in-scope network can be received, including outside the building
- An inventory of observed networks and access points, with any unknown or unauthorised ones flagged for follow-up
- Findings rated by business impact and likelihood, each with evidence, affected SSIDs and device groups, and a clear owner
- Specific remediation, for example migration to EAP-TLS, enforcing server certificate validation through MDM or group policy, removing legacy EAP methods, rotating and separating pre-shared keys, and tightening guest isolation
- Segmentation results: what each wireless network could reach on the wired side, mapped to the VLAN and firewall rules responsible
- Monitoring recommendations, such as wireless intrusion detection or controller alerts for rogue and look-alike access points
- A retest offer to confirm that fixes are effective, with evidence suitable for PCI DSS, ISO 27001 or NIS2 files
What to have ready before the test
Good preparation shortens the on-site time and makes the results more precise. These are the items we ask for at kick-off.
- A list of in-scope sites, floors and wireless networks (SSIDs), plus any you know are operated by third parties
- Signed authorisation from your organisation and, where relevant, from the landlord or managed Wi-Fi provider
- A short description of the authentication design: EAP methods, RADIUS or NAC platform, certificate authority, and how clients are configured
- The intended segmentation: which VLANs each SSID maps to and what guest and IoT networks should be able to reach
- A named on-site contact, building access for the testers, and agreed testing windows
- A test account or managed test device for authenticated checks, if in scope
- Escalation contacts in the network team and the SOC, so detection can be observed rather than mistaken for a real incident
How often to test wireless, and how we approach it
Wireless risk changes with your environment more than with the calendar. We recommend a full wireless assessment after an office move or a new site opening, after an access point or controller refresh, after any change to the authentication design (a new RADIUS or NAC platform, a new certificate authority, a move to WPA3), and when guest or IoT networks are redesigned. Between those events, organisations under PCI DSS still need quarterly rogue access point detection, and most others benefit from an annual check as part of their internal testing programme.
Our wireless assessments are performed on site by hands-on testers with 10+ years of offensive security expertise, led by OSCP-certified staff and reported with findings your network team can act on directly. We usually combine wireless with an internal network test so the report shows the full path from the car park to the critical system, and the remediation priorities that close it.
Frequently asked questions
Planning a wireless assessment?
We scope wireless testing alongside your internal network test so the report shows the full path from radio range to critical systems, and how to close it. Schedule a call with one of our testers.