WPA2 and WPA3 personal networks
We test shared-password networks for weak or reused passphrases and for whether a captured handshake could reveal the key.
Advisory
Wireless Penetration Testing
Can someone in your car park get onto your network? We test Wi-Fi sign-in, encryption, access points and the walls between wireless and internal zones.
Wireless penetration testing in Australia: Wi-Fi security tested on site.
Wireless penetration testing checks whether someone within radio range of your building can get onto your network, and what they could reach if they did. Wi-Fi signals travel past your walls into car parks, lobbies and neighbouring offices, so a weak setting can give an outsider the same access as a desk inside. We test corporate and guest Wi-Fi, how users and devices authenticate, how traffic is encrypted and how well wireless zones are separated from the rest of your network. Vectra is a CREST-accredited penetration testing provider, and our testers work on site across Australia.
What a wireless penetration test involves.
| Topic | Wireless penetration testing |
|---|---|
| Where it happens | On site, within radio range of the buildings in scope |
| Networks | Corporate, guest and special-purpose Wi-Fi networks |
| Focus | Authentication, encryption, access point configuration, rogue access points and segmentation |
| Standards tested | WPA2 and WPA3, personal and enterprise, including 802.1X and EAP |
| Delivery | Testers based in Australia, working nationally and visiting each site in scope |
| Retest | Retest of every High-severity finding and above |
| Quote | Scoped and quoted to your sites, buildings and networks |
What we test in a wireless penetration test.
A Wi-Fi network has several layers that can fail independently, so we test each one and then the paths between them.
802.1X and EAP enterprise networks
We check how devices validate the network's certificate and how credentials are handled, since weak client settings can leak staff logins.
Rogue and evil-twin access points
Where you permit it, we set up look-alike access points to see whether staff devices connect and hand over credentials.
Guest and corporate segmentation
We confirm that guest, corporate and privileged wireless zones are properly separated from each other and from internal systems.
Access point and controller administration
We look for exposed management interfaces, default passwords and outdated firmware on access points and wireless controllers.
What a stolen Wi-Fi password exposes
We join the network as an attacker would after a leaked password, then map everything that connection can reach.
Wi-Fi does not stop at your front door.
Your signal can reach the street, the car park and the office next door. A wireless penetration test treats that reach as part of your attack surface.
How we run a wireless penetration test.
Wireless testing follows our CREST-aligned approach, with extra planning for the physical site and the people using the network while we test.
-
Step 1: Scope and site plan
We agree the buildings, floors and wireless networks in scope, the test hours and whether rogue access point or client attacks are allowed.
-
Step 2: Survey and discovery
On site, we identify every network we can hear, including hidden ones, and note where your signal leaks beyond the building.
-
Step 3: Authentication testing
We test how each network signs people in, from shared passwords to certificate-based enterprise sign-in, looking for ways to capture or bypass credentials.
-
Step 4: Encryption and access points
We check encryption and protocol choices, and probe access points and controllers for exposed management services and weak configuration.
-
Step 5: Segmentation and post-access
Once connected, we test what the wireless network can reach, especially whether guest Wi-Fi is truly separated from corporate and privileged zones.
-
Step 6: Reporting and retest
You receive findings by site and network, practical configuration changes and a retest once the serious issues are fixed.
Wireless test scopes for different sites.
Head office and corporate Wi-Fi
The networks your staff and managed devices use every day, where a weakness can lead straight to internal systems.
- Enterprise sign-in and certificate checks
- Controller and access point configuration
- Routes from Wi-Fi into internal servers
Guest and visitor Wi-Fi
Networks for visitors, customers or contractors, which should give internet access and nothing more.
- Isolation from corporate networks
- Client-to-client isolation
- Captive portal and sign-up bypass
Branches and multiple sites
Retail stores, clinics, depots and regional offices often run the same Wi-Fi design, so one weakness can repeat everywhere.
- Sample or full-site coverage
- Consistency of configuration
- Central management exposure
Sensitive and high-security sites
Locations that hold regulated data, card payment systems or critical operations need firmer separation and tighter controls.
- Payment and cardholder zones
- Rogue access point detection
- Signal leakage beyond the boundary
When you need a wireless penetration test.
Wireless networks tend to be set up once and left alone, while the devices and threats around them keep changing. These are the usual triggers for a wireless pen test.
-
After an office move or fit-out
New buildings bring new access points, new cabling and new places where your signal escapes.
-
After a new Wi-Fi rollout
Changing vendor, controller or sign-in method is the right time to confirm the new design works as intended.
-
When you offer guest Wi-Fi
Visitor networks must give internet access and nothing more, and that separation is worth proving.
-
When you handle card payments
Retail and hospitality sites need wireless networks kept clear of the cardholder data environment.
-
For sensitive sites
Offices that hold regulated data or run critical operations need independent proof that the wireless edge is closed.
Wireless penetration testing across Australia.
Wireless testing has to happen in radio range, so a tester comes to your site.
For organisations with many locations, we plan visits so a single engagement covers several sites, and we agree the hours and areas we can work in before we arrive. To talk about a wireless test, call any of our offices.
-
Adelaide
Headquarters and 24/7 SOC. 145 South Terrace, Adelaide SA 5000. +61 8 8208 0800.
-
Sydney
3 Spring Street, Sydney NSW 2000. +61 2 9276 1800.
-
Melbourne
454 Collins Street, Melbourne VIC 3000. +61 3 9036 3800.
-
Perth
Level 3, 1060 Hay Street, West Perth WA 6005. +61 8 6365 4090.
-
Canberra
Government office, Australian Capital Territory. +61 2 9276 1800.
-
Brisbane
Queensland office. 1800 816 044.
Checklist: before a wireless penetration test.
Sorting these out early means our time on site goes into testing rather than logistics.
-
List the sites, buildings and floors in scope, with the network names you expect us to find.
-
Arrange site access, parking and an escort if your buildings need one.
-
Tell reception and building security when a tester will be on site.
-
Decide whether rogue access point and client attacks are permitted.
-
Provide a test account and device profile for any enterprise network.
-
Name a contact who can approve changes on the day.
What you receive after a wireless penetration test.
Wireless results are organised by site and network, so the team that manages your Wi-Fi can see exactly which configuration to change. The full list of what every Vectra engagement includes is on our penetration testing services page.
-
Findings by site and network
Each issue tied to the building, network name and access point where we found it, with evidence.
-
Configuration changes
Specific settings to change on controllers, access points and client devices, ranked by risk.
-
Executive narrative
A short summary of wireless risk that leaders and auditors can read without a technical background.
-
Debrief and retest
A walkthrough with your network team, a retest of every High-severity finding and above, and 90 days of portal access.
Compliance a wireless penetration test supports.
Our reports can be mapped to the frameworks you report against. Wireless testing is most often linked to these.
- PCI DSS. Requirement 11.2 covers wireless access point management and the quarterly check for unauthorised access points. Requirement 11.4.5 covers segmentation testing, which a wireless test supports when Wi-Fi sits near the cardholder data environment. See our PCI DSS services.
- ISO 27001. Wireless testing provides evidence for network security and network segregation controls. See ISO 27001.
- The ISM. The Australian Government Information Security Manual includes guidance on wireless networks, and testing helps show those controls are in place. See the ISM.
- APRA CPS 234. Wireless networks are part of the information security controls regulated entities must test. See APRA CPS 234.
Related penetration tests.
Network penetration testing
External and internal testing of the wired network your Wi-Fi connects to.
Red team and physical testing
On-site intrusion, tailgating and device-drop tests inside a goal-led red team.
OT and ICS penetration testing
Safety-first testing for plants and sites where wireless links reach control systems.
Get a scoped wireless penetration testing quote.
Tell us how many sites and networks you have. We scope each engagement to your locations and quote to that scope.
Wireless penetration testing FAQs.
Do you need to be on site for a wireless penetration test?
Yes. Wireless testing has to happen within radio range of your networks, so a tester visits each site in scope. Before we arrive, we agree which buildings, floors and networks are in scope. We plan visits around the hours and areas you approve, and one engagement can cover several sites.
Will wireless testing disrupt our users?
Most wireless testing is passive or targets our own test connections, so users do not notice it. Some techniques, such as rogue access points or forcing devices to reconnect, can affect users briefly. We only use those with your approval in the rules of engagement, and we agree limits on any action that could disrupt service.
Can you test Wi-Fi across several sites?
Yes. Many organisations run the same wireless design at every branch, store or clinic. We can test every site, or test a representative sample and check that the configuration is consistent across the rest. We agree the approach with you during scoping, based on how your sites are managed and where sensitive data sits.
Do you test WPA3 and enterprise Wi-Fi?
Yes. We test personal networks that use a shared password, under WPA2 or WPA3, and enterprise networks that sign users in with 802.1X and EAP. For enterprise networks, we focus on certificate validation and credential handling, because weak client settings can let an attacker capture logins with a fake access point.
Does a wireless pentest help with PCI DSS?
It can. PCI DSS expects you to manage wireless access points and check for unauthorised ones every three months, under requirement 11.2. A wireless penetration test does not replace that routine check, but it does show whether wireless networks can reach the cardholder data environment, and it supports the segmentation testing in requirement 11.4.5.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.