WiFi and wireless network security audit
A misconfigured corporate WiFi network is a direct gateway into your internal network. We assess the security of your wireless infrastructure using the OWISAM methodology.
Scope your project · Request a WiFi audit
Rather talk it through? Call us at +34 960 730 013
Why is corporate WiFi a common attack vector?
A single misconfigured WiFi network is enough to open the door to your whole corporate network, and most offices run several. Weak WPA2 passwords susceptible to dictionary attacks, unsegmented guest networks, rogue access points installed without authorization, or a lack of Evil Twin detection are real vectors attackers exploit to gain initial access to the corporate network.
Scope of the WiFi audit
- Inventory and mapping of access points: authorized and unauthorized (rogue AP)
- Protocol assessment: WEP, WPA/WPA2-Personal, WPA2/WPA3-Enterprise (802.1X)
- WPA2 handshake capture and cracking attacks (dictionary, PMKID)
- Evil Twin and KARMA attack detection
- Segmentation: corporate vs. guest vs. IoT networks
- RADIUS and 802.1X authentication assessment
- Deauthentication and wireless denial-of-service attacks
- Coverage analysis and exposure beyond the physical perimeter
- OWISAM methodology (Open Wireless Security Assessment Methodology)
OWISAM methodology
- Wireless reconnaissance: Identification of every WiFi network within the client's perimeter: SSIDs, BSSIDs, channels, signal strength and protocols.
- Configuration analysis: Assessment of authentication protocols, encryption and wireless controller configuration.
- Attack testing: Controlled attacks: handshake capture, Evil Twin, captive-portal bypass, attacks against 802.1X.
- Post-exploitation: If access is obtained, we verify the network's real segmentation and the potential for lateral movement.
- Report and remediation: Findings mapped by severity, photographic/technical evidence and configuration recommendations for the wireless systems.
Deliverables
- Complete map of WiFi infrastructure (authorized and unauthorized)
- Technical report with findings classified by severity
- Evidence of access obtained (if applicable)
- Vendor-specific configuration recommendations (Cisco, Aruba, Ubiquiti, etc.)
- Wireless network segmentation guide
Use cases
- Corporate offices with multiple SSIDs and BYOD policies
- Hotels, hospitals or shopping centers with guest WiFi
- Industrial environments with WiFi-connected IoT devices
- Companies with remote workers using uncontrolled networks
- Organizations that must comply with PCI-DSS with wireless payment terminals
Frequently asked questions
Do you need to be physically on our premises?
For the full assessment, yes. Wireless network analysis requires physical presence. We schedule visits at times that minimize disruption to your operations.
Does the WiFi audit include guest networks?
Yes, we include every wireless network within the perimeter: corporate, guest, IoT and any unauthorized network we detect.
Do you also assess the security of devices connected to the WiFi?
The standard scope covers the wireless infrastructure. If you want to include an assessment of connected devices (IoT, PCs, printers), we extend it as part of an internal network pentest.
Does somebody need to come to our offices in person?
Yes. A serious WiFi audit requires physical presence, because much of what is assessed depends on real signal propagation: how far it reaches from the street or the parking lot, what is visible from a waiting room, whether an unauthorized access point would go unnoticed. What can be prepared remotely is the review of controller configuration and network documentation.
Will the network go down during testing?
Under normal conditions, no. Most of the work is passive: capture, observe and analyze. The tests that can affect service — deauthenticating clients to capture a handshake, or standing up a twin access point — are agreed beforehand and run in a scheduled window, usually outside peak hours. They are never launched unannounced.
We already have WPA3. Do we still need the audit?
WPA3 closes specific attacks against the previous protocol, but not the ones most exploited in practice. Most findings in a corporate WiFi audit are not cryptographic: they are segmentation issues — a guest network that reaches the internal one — unauthorized access points plugged in by somebody inside the company, shared credentials that never rotate, and legacy devices that force compatibility modes which cancel out the improvement.
Related resources
Ready to protect your business?
Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.