Wi-Fi Penetration Testing
Wi-Fi penetration testing.
Test who can join your wireless network, what their devices trust and which systems they can reach. Receive evidenced findings, prioritised fixes and an included retest within an agreed scope.
From radio signal to verified boundary.
Agree the sites, networks and roles before testing how access is granted.
A wireless signal should not become a path to your internal systems.
Your wireless boundary extends beyond the reception desk. A visitor, a device in an adjacent room or a compromised employee laptop may be close enough to interact with it. Strong encryption is only one part of the answer: authentication, client configuration and the network access granted after connection matter too.
We test the agreed wireless networks and the boundaries around them. That includes how users and devices authenticate, whether clients recognise a trusted network correctly, and whether guest or unmanaged devices can reach corporate services. We demonstrate reachable paths with authorised accounts and controlled test data.
What we can include
- Agreed locations, SSIDs, access points and wireless client profiles
- WPA2/WPA3-Personal configuration and shared-key handling
- WPA2/WPA3-Enterprise, 802.1X, EAP and server-certificate validation
- Guest networks, captive portals and client isolation
- Segmentation between corporate, guest, BYOD and IoT networks
- Rogue access-point and impersonation scenarios, explicitly authorised
- Access to agreed internal services after joining the network
- Wireless monitoring and alert validation, where included
Why it matters
Test the connection. Then test the trust behind it.
A wireless network can authenticate a device correctly and still grant it more access than intended. A guest client may reach a management interface, an IoT network may share a route into the corporate environment, or one connected client may be able to reach another. We check those paths against the access model you intended.
Enterprise Wi-Fi also relies on the client making the right trust decisions. We examine the agreed authentication methods and certificate checks, using dedicated test identities where possible. The objective is to demonstrate a security boundary and its impact, not to collect staff credentials.
PXLSec / WI-FI
Three questions about wireless access.
Explore the boundaries we validate within your agreed scope.
01Who can connect?
Authentication and client trust
Review the agreed WPA2/WPA3 modes, key handling, 802.1X/EAP and server-certificate validation. Use test identities and controlled client devices.
02What can they reach?
Isolation and segmentation
Check whether a guest, BYOD or IoT device reaches only its intended services. Compare actual access paths with your policy, including isolation between clients.
03Will the attempt be noticed?
Monitoring and controlled active scenarios
Where explicitly authorised, validate the response to impersonation or rogue access points. Potentially disruptive techniques require a separately agreed window and stop conditions.
How it works
Scope the locations
Agree sites, SSIDs, access-point identifiers, client devices, test accounts, permitted techniques and stop conditions.
Map and review
Observe the authorised wireless environment and review relevant access-point, controller and client configuration.
Validate access and isolation
Test authentication and client trust, then verify what each agreed wireless role can reach. Active scenarios stay within the approved windows.
Report and retest
Explain the findings, prioritise changes and verify the agreed fixes. Radio-dependent retesting may require another site visit.
Why PXLSec
Beyond the Wi-Fi password
Authentication and client trust
Assess personal and enterprise wireless configuration, identity controls and how the agreed client profiles validate the authentication server.
Guest and device isolation
Test separation between guests, staff, unmanaged devices and IoT, including agreed routes to internal services and isolation between clients.
Access-point impersonation, scoped
Where explicitly permitted, use controlled rogue or impersonation scenarios to check client behaviour and monitoring. Nearby networks and unrelated users stay outside the test.
Evidence your network team can use
Record the affected SSID and role, the relevant configuration and the reachable service or failed control. Recommendations address the boundary that allowed the path.
What you receive
Clear deliverables, agreed in the proposal, with no surprises at the end of the engagement.
- Executive summaryBusiness impact and the most important access or isolation gaps.
- Technical evidenceAffected networks, prerequisites, observed behaviour and reproducible evidence using controlled test data.
- Remediation planPrioritised changes for authentication, client profiles, segmentation and monitoring.
- Included remediation retestVerification of reported fixes within the scope, access arrangements and window agreed in your proposal.
When you need this
When wireless testing is useful
Choose the sites and scenarios around the change or assurance question you need to resolve.
A new office or wireless rollout
Validate access rules, enterprise authentication and guest separation before the environment becomes business-critical.
A controller or identity migration
Check whether new access points, certificates, RADIUS settings or client profiles preserve the intended security model.
Visitors, contractors and connected devices
Find out what a guest, BYOD or IoT device can actually reach, rather than relying only on VLAN names.
Customer or internal assurance
Provide independent technical evidence for your risk and assurance programme. A wireless test is not, by itself, regulated TLPT or a compliance certification.
Methodology & standards
References matched to the wireless scope
- NIST SP 800-115
- NIST SP 800-153
- PTES
- IEEE 802.11 and 802.1X security concepts
- Vendor wireless and client-hardening guidance
FAQ
Questions we're often asked
Do you need to visit our office?
Usually, yes. Radio-layer testing requires an authorised tester or an agreed, suitable test setup within range of the in-scope networks. Configuration review and parts of segmentation validation can be remote. Sites, travel and access arrangements are specified in the proposal.
Can testing interrupt our Wi-Fi?
We start with observation and agreed low-impact checks. Deauthentication, availability testing, active impersonation and any scenario likely to disrupt users require explicit permission, a defined window and stop conditions. They are not included by default.
Do you test WPA3 and enterprise Wi-Fi?
Yes, according to the deployed modes and client capabilities. Scope can include WPA2/WPA3-Personal and Enterprise, 802.1X/EAP configuration, authentication-server trust and relevant controller/client settings. The proposal states which networks, devices and methods are included.
Will you capture employee passwords?
We prefer dedicated test accounts and controlled clients. Any scenario involving credentials, employee participation or sensitive traffic requires explicit agreement and data-handling rules. We minimise collected data and report evidence without unnecessary personal information.
Is an internal network penetration test included?
We can validate specific paths from an agreed wireless role to named internal services. A broader internal network or Active Directory assessment is a separate scope; joining Wi-Fi does not automatically authorise testing the whole estate.
What information do you need for a proposal?
The locations, SSIDs, approximate access-point count, authentication methods, device types, guest/IoT separation and preferred test window. Tell us whether configuration access, test identities and on-site access are available. Do not send passwords through the public form.
What does the retest include?
We verify reported fixes under the agreed scope and remediation window. Some checks can be repeated remotely; radio-dependent checks may need another site visit. The proposal makes those arrangements clear.
Related services
Discuss your testing scope.
Tell us what you want to protect. A senior tester will help you agree the scope and next steps. We usually reply within one business day.
Confidential from the first conversation
We can sign your NDA before you share sensitive details. Your enquiry is covered by our privacy policy.
How we protect your information · Privacy policy