Wi-Fi Security Audit

A wireless assessment is four measurements, taken in this order, and each one produces a different artefact. They are separated because the first three are read-only and can usually be taken in production hours, while the fourth needs a change window and a named engineer on the other end of a phone.

The first pass is inventory. We walk the estate and log every BSSID in range - yours, the neighbours, the printer's, the one in the meeting room nobody has logged into since the last office move - then reconcile the observation list against the list of access points you believe you own. That reconciliation, not the scan, is the finding: an office with 120 staff and 28 managed access points routinely turns out to have 34 radios answering to its name, and each surplus radio has an owner, a cable, or a procurement decision behind it.

The second pass is per-SSID authentication. For every service set we record the method actually negotiated by each client class rather than the method configured on the controller, because those two records disagree more often than they agree. A corporate SSID configured for WPA3 in transition mode still negotiates WPA2 with the scanner in the warehouse, and an 802.1X SSID whose clients skip server certificate validation is collecting credentials for anyone who broadcasts the same name.

The third pass is reachability. From each SSID we test what an associated device can actually reach - internal hosts, ports, the printer VLAN, the management subnet, the guest network in the other direction - and report it as a matrix of tested targets rather than an adjective. The fourth pass is client behaviour: which managed devices join a remembered SSID presented by a different BSSID, and which of them warn the user before doing it.

The authorisation is the first deliverable, not paperwork that follows the invoice. Before a radio is configured we hold a written scope naming the legal entity that owns the network, the sites and floors in scope, the SSIDs and BSSIDs explicitly in scope, the testing window, the contact who can stop the test, and the data-handling rules for anything captured. The signatory has to be able to authorise the network - a managed service provider can commission an assessment of a client estate only with the client's written agreement, and we ask for that letter rather than accepting a purchase order as evidence of it.

Passive work runs first: listening needs no credential, no association and no interruption, so the inventory and the radio survey can be taken during business hours without anyone noticing. Active work - associating as a client, attempting the pre-shared key against captured material, testing reachability, and any frame injection - runs inside the agreed window, ideally out of hours, because deauthentication techniques knock real devices off a production floor and a warehouse scanner that drops its connection mid-pick is a business outage, not a test.

We agree the stop conditions in writing too: a safety-critical system that must stay associated, a medical device class that cannot be touched, a floor that is out of scope because a tenant occupies it. The engineer running the test carries that list, and the report records every action taken against the clock so that any unexpected client-side disconnection can be attributed or excluded.

Every finding in the report names the measurement that produced it, the location it was measured from, and the artefact that proves it. A pre-shared key finding is not a line saying the password is weak - it is the capture method, the key-derivation cost, the keyspace of the passphrase class, and the arithmetic showing how long a full sweep would take at a stated guess rate. That distinction matters commercially: a key that survives 232 years of GPU time is not the finding, and the finding is instead that one shared secret is held by every person who has joined the network since 2019 and cannot be rotated without touching every device.

A segmentation finding is a matrix row, not a claim: from the guest SSID, three of three tested printers on the corporate subnet answered, which means guest isolation is a policy rather than a control. A rogue access point finding names the switch port, the Power over Ethernet draw and the OUI that correlate the radio to the wire, because a transmitter the sweep can hear but cannot place is a photograph, not a finding. A client-behaviour finding names the device class, the operating system version and the setting that let it join a lookalike network.

Each finding also carries an owner and a fix that can be verified from outside the network. Removing an unauthorised access point is verifiable by a second sweep. Pushing a certificate-validation profile is verifiable by reading the supplicant configuration on the device, not by trusting that the profile applied. Rotating a shared key is verifiable by confirming that the old key no longer associates. If a remediation cannot be checked that way, we say so and propose the check before the work is accepted.

Wireless work is priced by site, access point count, and whether the engagement includes active testing inside a change window. The bands below reflect what a professionally run assessment costs in the UK market, and they match the cost section of our published wireless guide so that a figure seen on this page can be checked against the methodology behind it.

A single site with one to five access points and one or two SSIDs is commonly quoted at around GBP 3,000 to 4,000 for one to two tester days, roughly USD 4,100 to 5,500 at prevailing rates. A multi-floor office with six to twenty access points, enterprise authentication and guest isolation runs around GBP 4,000 to 8,000. A campus with several buildings, IoT and operational technology in scope starts at GBP 8,000 to 20,000 and moves upward with the number of sites and the amount of wired correlation required. Travel and out-of-hours work add GBP 1,000 to 5,000 on multi-site engagements, and out-of-hours testing is often necessary rather than optional, which is why it belongs in the quote instead of arriving as a variation.

Duration follows the same shape: a single-site passive survey with a report is typically a week from kick-off, a multi-floor engagement with active testing and one retest is two to three weeks, and a campus assessment is scheduled around change windows rather than promised as a fixed number of days. A retest after remediation is quoted separately, so that the acceptance test has a price attached to it before the first sweep begins.

A radio assessment cannot tell you what it did not hear. If a rogue access point was switched on for two hours on a Sunday and removed, no sweep on Tuesday will find it; that gap is closed by the controller's own rogue-detection log and by continuous monitoring, which is a different purchase. An assessment is a sample of the radio estate at a point in time, and the report says so rather than implying continuous assurance.

It also cannot see past modern encryption. If the estate runs WPA3 with protected management frames and per-device certificates, there is no offline attack on the capture, and any claim to have decrypted client traffic on a properly configured network is either a misstatement or evidence that the configuration was not what the controller reported. What the assessment can prove on such a network is reachability, client behaviour, credential hygiene and inventory - which is where the real findings usually live anyway.

Three further exclusions belong in the report rather than in the sales conversation: the wired side beyond access point correlation, physical security and cable access, and the supply chain behind the access points themselves - firmware provenance, the cloud controller account, and the vendor's default credentials. The cloud management plane is worth naming explicitly, because a wireless controller account is now an internet-facing administrative login that can push a configuration to every radio in the estate, and phishing it is a faster route to a rogue SSID than any radio technique in this document.

Wireless testing sits closer to the legal line than most security work, because the radio perimeter extends into space you do not own. Every engagement here is scoped to networks the client owns or is written-authorised to test, and the authorisation names the SSIDs and BSSIDs, not just the building. Evaluating a neighbour's network, a shared building's management network, or a conference venue's Wi-Fi is out of scope regardless of how interesting the signal is, and a sweep that observes those networks records the observation and nothing more.

The same rule decides what a residential engagement can be. A home network can be assessed when the person commissioning it owns the connection and the router - a parent reviewing the wireless security of their own household, for example, or a small business owner working from a converted garage. It cannot be run against a partner's, a tenant's or an adult family member's network without that person's own consent, and no assessment of a device you do not own will be offered, however the request is framed.

Where the client operates in a regulated sector, the report is written so that it can be handed to an auditor without redaction drama: findings are separated from raw evidence, credentials and captured material are described rather than reproduced, and any personal data encountered in logs is minimised at collection. If a standard or an insurer requires a quarterly sweep, the repeat engagement is an inventory and rogue-detection sweep rather than a full assessment, and we will say which of the two you are actually being sold.