Skip to content

Wireless networks are the most frequently-overlooked entry point in regional enterprises. They reach beyond the physical perimeter, often use legacy authentication, and are routinely deployed by facilities teams without security review. Wireless penetration testing is what turns that surface from "we have Wi-Fi" into a quantified security position.

Engagements typically combine remote pre-engagement work, checking 802.1X / RADIUS configuration, certificate handling, and policy posture, with on-site wireless capture and active attack-path testing within the radio range of your facilities.

Coverage spans the corporate SSID, guest networks, BYOD segments, and operational technology wireless deployments where in scope. Findings include both immediate vulnerabilities and longer-term posture issues like segmentation, monitoring, and rogue-AP detection.

What's at stake.

Wireless reaches outside your physical perimeter

Adjacent buildings, car parks, lobbies, wireless signal frequently extends well beyond where physical security ends. The attack surface is uncontrolled by design.

Authentication missteps compound quickly

802.1X / RADIUS misconfigurations, missing certificate validation on clients, and weak passphrase policies are routine, and they each give an attacker corporate-credential equivalent access.

Segmentation between wireless and core often does not exist

Once on the wireless network, can the attacker reach domain controllers, production servers, or OT systems? The answer is too often "yes, with no further authentication required".

What we test.

Encryption & authentication

How the network proves who clients are and how their traffic is protected, including the 802.1X / RADIUS pathway most enterprises actually rely on.

  • WPA2 / WPA3 implementation weaknesses
  • Weak passphrases and PSK exposure
  • WPS PIN vulnerabilities
  • 802.1X / RADIUS configuration
  • Certificate handling and validation

Attack vectors & segmentation

Active attack-path testing within radio range, plus how access to wireless translates into access to the rest of the network.

  • Evil twin and rogue access points
  • MAC spoofing and bypass of MAC filtering
  • Deauthentication and downgrade attacks
  • Man-in-the-middle on wireless clients
  • Segmentation between wireless and core
  • Logging, monitoring, and rogue-AP detection

The flaws engagements like this consistently surface.

Drawn from common categories our consultants surface across engagements of this type. Severity and prevalence vary by environment and maturity.

Weak certificate validation on corporate Wi-Fi

Clients accepting any certificate signed by any CA, no certificate pinning to the RADIUS server, evil-twin attack paths trivially available.

Passphrase leakage

Pre-shared keys handed out via reception desks, on training-room whiteboards, or via help-desk tickets without rotation.

No segmentation post-association

Once associated to corporate Wi-Fi, full reachability to internal services with no further authentication required.

Guest network bridging

Guest networks accidentally bridged to corporate VLANs through misconfigured controllers or shared infrastructure.

A structured, intelligence-led path through every engagement.

Every engagement follows the same disciplined path through the Velocity platform, so quality, traceability, and reporting are consistent across teams.

Scoping

Define assets, environments, Rules of Engagement, and acceptance criteria with the technical and security stakeholders.

Execution

Manual and tool-assisted testing by CREST-accredited consultants, with evidence captured at each step.

Validation

Every finding is reproduced, risk-rated under CVSS, and confirmed by a second consultant before reporting.

Reporting

Cryptographically signed reports with test-case traceability, severity ratings, reproduction steps, and remediation guidance.

Debrief & Retest

Stakeholder walk-through of findings, prioritisation support, and a retest cycle on remediated issues.

Mapped to recognised baselines.

IEEE 802.11
NIST SP 800-153
CIS Benchmarks

Common buyer questions.

Do you need to be on-site? +

For active wireless testing, yes, testing happens within radio range. Configuration review and policy assessment is done remotely. Most engagements combine both.

Will testing disrupt our wireless users? +

Deauthentication and similar techniques are disruptive by design. We schedule disruptive testing in agreed windows or in low-occupancy times, and avoid critical operational segments unless explicitly scoped.

Can you cover multiple sites? +

Yes. Multi-site engagements are common, typically one anchor site with full coverage and lighter targeted testing at remote sites for consistency checks.

Test Your Defences Against Adversarial Expertise

Talk to a CREST-accredited consultant about your next penetration testing engagement.