Wireless Security Testing
Wireless penetration testing and Wi-Fi security tests carried out on site, from where an attacker would stand. We find out whether someone in your car park can get onto your network and what they could reach once they do.
What the Test Covers
A wireless security assessment looks at every network your organisation broadcasts: corporate, guest, IoT and anything else on the air. The tester works inside and outside the building, within range of your access points, the same way an attacker would. Encryption, authentication, access point configuration and the separation between wireless and wired networks are all tested. So is whether your staff’s devices will happily connect to a network that only looks like yours.
Where Wireless Goes Wrong
A single shared password that has not changed since the office opened, known to every former employee and contractor. Guest Wi-Fi that reaches the printers, the file server or the management pages of the access points themselves. Enterprise networks that accept any certificate, so a fake access point can collect staff usernames and password hashes as people walk past. Legacy encryption kept on for one old device. None of these needs specialist kit to exploit. Someone with a laptop in the car park is enough.
Why It Has to Be On Site
Wireless can only be tested from within range, so this is always on site work. It pairs naturally with an internal test, where it usually adds about a day to the visit. Travel is always included in the price.
What You Get From the Test
Every Network Found
Corporate, guest and IoT networks mapped, along with any access points nobody authorised.
Proof of What Is Reachable
If the tester gets onto a network, the report shows exactly what could be reached from it.
Guest Isolation Confirmed
A clear answer on whether guest and personal devices are kept away from your internal systems.
Fixes for Your Kit
Configuration changes for your wireless controller and access points, in priority order.
How the Test Runs
We agree the scope in writing first: the sites, the networks to test and any that must be left alone. On site, the tester surveys the airspace to identify every network and access point, including rogue ones. Each network’s encryption and authentication are checked, shared passwords are tested for strength and enterprise networks are tested to see whether a fake access point can capture staff credentials. If access is gained, the tester checks what can be reached and whether guest, staff and corporate networks are properly separated. With your agreement the test is repeated as an authenticated device to see what a connected laptop or phone can reach. Anything critical is reported the moment it is confirmed.
At a Glance
Network Discovery
Identifying all wireless networks, access points and any rogue devices.
Configuration Review
Encryption, authentication methods and legacy standards checked on every network.
Authentication Testing
Shared password strength, handshake capture and fake access point attacks.
Segmentation Testing
Verifying guest, staff and corporate networks are properly isolated.
Report & Retest
All findings with clear, practical remediation steps. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What does wireless security testing involve?
An on site test of every wireless network you broadcast. The tester checks encryption and authentication, tries to get onto each network from outside it, tests whether a fake access point can capture staff credentials and confirms whether guest and corporate networks are kept apart. It is carried out from within range of your access points, which is where an attacker would have to be.
What wireless vulnerabilities are most commonly found?
A shared password that has not changed in years, guest networks that can reach internal systems, enterprise networks that do not check the server certificate, legacy encryption such as WEP or TKIP left enabled and missing client isolation. We also look for rogue access points, whether they were set up by staff or by someone else.
Is wireless testing required for Cyber Essentials Plus?
No. Cyber Essentials Plus does not include wireless penetration testing. A wireless test answers a different question: whether someone in range of your building could get onto your network. It also supports PCI DSS where card data is involved.
Do you need access to our Wi-Fi credentials to perform the test?
Not to start. We test first as an outsider with no credentials, which is the position an attacker in range would be in. With your agreement we then connect as a normal user or device to check what a connected device can reach. Both are needed for a complete picture.