Penetration Testing
Wireless Penetration Testing
Wireless penetration testing is an on-site test of your Wi-Fi networks that checks encryption, authentication and guest segregation, and hunts for rogue access points that could bridge into sensitive systems. As a PCI SSC-approved QSA company, we document rogue wireless detection so it stands as PCI DSS Requirement 11.2 evidence.
Prefer to talk? Call +44 161 523 5276
- Corporate and guest Wi-Fi testing
- Rogue wireless detection (PCI 11.2)
- Guest-to-internal segregation checks
Trusted by banks, payment providers and global brands
On this page
- Wireless network penetration testing: what's included
- What we test for
- Is wireless penetration testing still needed?
- Wireless security assessment or wireless penetration test?
- Which tools are used for wireless penetration testing?
- How long does an on-site wireless test take?
- How is a wireless penetration test carried out?
- Why choose Sovereign Secure for wireless penetration testing?
- Frequently asked questions
Overview
What is wireless penetration testing?
The short answer
Wireless penetration testing is an on-site test of your Wi-Fi networks. A tester checks encryption and authentication (WPA2, WPA3 and 802.1X), tries to break the separation between guest and corporate networks, imitates trusted networks with evil twin access points, and hunts for unauthorised access points, documented as PCI DSS Requirement 11.2 evidence.
Wireless networks extend your perimeter beyond the walls of the building. Wireless network penetration testing assesses the security of your Wi-Fi, checking encryption and authentication, testing whether guest and corporate networks are properly separated, and looking for the misconfigurations that let an attacker onto the internal network.
For PCI, we also carry out rogue wireless detection: identifying unauthorised access points and devices that could bridge into the cardholder data environment. This addresses PCI DSS Requirement 11.2, which expects checks at least every three months, and as a QSA company we document it so it stands as evidence. Our wireless security audit checklist lists the ten checks to run between tests.
Wireless testing pairs naturally with an internal penetration test, since a foothold gained over Wi-Fi quickly becomes an internal-network problem. Where wireless could reach your cardholder data environment, we include it in PCI DSS penetration testing and segmentation checks.
Wireless testing needs a tester on site. From our head office in Accrington we cover wireless penetration testing in Manchester and the North West, and we travel to sites elsewhere in the UK. Our guide to the types of penetration testing compares this test with the others.
What's included
Wireless network penetration testing: what's included
A Wi-Fi penetration testing engagement covers your networks, their controls and rogue-device detection.
- 01
Wi-Fi security assessment
Testing of encryption, authentication and configuration across your wireless networks.
- 02
Rogue access point detection
Identification of unauthorised access points and wireless devices, addressing PCI DSS 11.2.
- 03
Network segregation testing
Verification that guest and corporate networks are properly separated and that guest Wi-Fi cannot reach internal systems.
- 04
Authentication testing
Assessment of the wireless authentication in use, from pre-shared keys to enterprise authentication.
- 05
Client and device checks
Testing for misconfigured clients that could be tricked into connecting to a malicious network.
- 06
Coverage and leakage review
Assessment of how far your wireless signal reaches beyond your controlled space.
- 07
Manual verification
Every finding confirmed by hand, with clear evidence.
- 08
Retest
A retest of remediated findings, scoped in your fixed-price proposal, with the report updated to show them closed.
What we test for
What we test for
Coverage spans wireless configuration, authentication, segregation and rogue devices.
Encryption and configuration
Weak or outdated wireless protection that exposes traffic and access.
- Weak or deprecated encryption (WEP, WPA)
- Insecure WPA2 configurations
- WPA3 transition-mode downgrade exposure
- Default or weak pre-shared keys
- Insecure management interfaces
- Poorly configured access points
Authentication
Flaws in how users and devices authenticate to the wireless network.
- Weak pre-shared keys
- Enterprise authentication misconfigurations
- Certificate validation weaknesses
- Credential-capture exposure
- Insecure onboarding of devices
Rogue and unauthorised devices
Unauthorised wireless that could bridge into sensitive networks (PCI DSS 11.2).
- Detection of rogue access points
- Unauthorised wireless devices
- Evil-twin and impersonation exposure
- Unmanaged access points
- Wireless bridging into the cardholder data environment
Segregation and access
Whether wireless boundaries actually hold.
- Guest-to-internal network isolation
- Reachability of internal systems over Wi-Fi
- VLAN and segmentation enforcement
- Access to management interfaces
- Firewalling between wireless and wired networks
Client-side and signal
Risks from client behaviour and signal reaching beyond your space.
- Clients that auto-connect to known names
- Susceptibility to malicious access points
- Signal leakage beyond controlled areas
- Insecure hotspot use by staff
- Preferred-network-list exposure
Is wireless penetration testing still needed?
Yes, for most organisations with offices, shops or warehouses. Cloud services and zero trust have reduced what an attacker gains by joining a Wi-Fi network, but in most buildings the wireless network still reaches printers, payment terminals, building systems and internal servers. A weak pre-shared key or a guest network that is not properly separated can put an attacker on the inside from the car park, and wireless pen testing shows whether that is possible at your sites.
| Reason | What the test checks |
|---|---|
| PCI DSS Requirement 11.2 | Authorised and unauthorised wireless access points are identified at least every three months, even at sites that run no wireless of their own |
| Guest isolation | Guest Wi-Fi cannot reach corporate systems, payment devices or management interfaces |
| Pre-shared key strength | Whether a captured WPA2 handshake can be cracked offline to recover the network key |
| Evil twin access points | Whether staff devices connect to a fake access point and hand over credentials through a cloned login page |
| 802.1X configuration | Whether clients check the server certificate, or leak domain credentials to a rogue access point |
A rogue device can also be planted by someone who simply walks in, so wireless checks pair well with physical penetration testing of the same site.
Wireless security assessment or wireless penetration test?
A wireless security assessment reviews how your Wi-Fi is set up: a survey of the networks and access points in range, a check of encryption and authentication settings against good practice, and a sweep for rogue devices. A wireless penetration test goes further and attacks those networks the way an intruder would, cracking captured keys, imitating trusted networks and trying to reach internal systems from the guest network, so you see what each weakness actually exposes.
| Aspect | Wireless security assessment | Wireless penetration test |
|---|---|---|
| Question it answers | Is our Wi-Fi configured to good practice, and is anything unauthorised in range? | What could an attacker reach through our Wi-Fi? |
| Method | Survey, configuration review and rogue access point sweep | Active attacks on keys, authentication, client devices and network segregation |
| Typical use | Quarterly rogue access point checks for PCI DSS 11.2 and routine reviews | Annual testing and after a new site, network or access point model goes live |
| Output | An inventory of networks and access points, with configuration gaps | Proven attack paths with evidence, risk ratings and fixes |
Many organisations need both: the lighter assessment every quarter where PCI DSS applies, and a full wireless network penetration test once a year or after significant change.
Which tools are used for wireless penetration testing?
Wireless testing relies on open-source tools and wireless adapters that can listen to and inject traffic. The tools below are ones testers commonly use; what matters more is how the tester interprets the results.
| Task | Tools testers commonly use |
|---|---|
| Discovery and survey | Kismet, airodump-ng from the Aircrack-ng suite, and Wi-Fi survey software |
| Capturing handshakes | hcxdumptool and Aircrack-ng, to capture WPA2 handshakes and PMKIDs |
| Testing key strength | Hashcat or Aircrack-ng with wordlists, run offline against captured handshakes |
| Rogue and evil twin access points | Tools built on hostapd, such as EAPHammer and hostapd-mana |
| Traffic analysis | Wireshark, to inspect captured traffic and protocols |
| Hardware | Adapters that support monitor mode and packet injection, plus directional antennas |
Tools gather evidence; a manual test decides what each finding means, such as whether a cracked key actually leads to internal systems.
How long does an on-site wireless test take?
A single office with one corporate and one guest network can usually be tested in one or two days on site, with the report following. Each extra building, floor, site or network adds time, and these factors set the total:
| Driver | Effect on duration |
|---|---|
| Sites and buildings | Each location needs its own survey and on-site testing, plus travel between them |
| Floor area | Larger or multi-storey buildings take longer to survey for rogue access points and signal leakage |
| Wireless networks and authentication methods | Corporate, guest, IoT and payment networks are each tested, and pre-shared key and 802.1X networks need different attacks |
| Client and evil twin attacks | Testing whether staff devices connect to a fake access point needs time while people are on site |
| Testing hours | Work outside office hours, or around shop and warehouse trading, can spread the testing over more visits |
| PCI DSS rogue access point checks | Quarterly checks under Requirement 11.2 are much shorter than a full wireless penetration test |
Our penetration testing cost guide explains how days turn into a price, and the wireless penetration testing quote form collects the sites and networks we need to scope your test.
How it works
How is a wireless penetration test carried out?
- 1
Scoping
We agree the sites, networks and access required, and confirm whether rogue detection for PCI is in scope, then fix the price.
- 2
Survey
We survey the wireless environment on site, mapping networks, access points and signal coverage.
- 3
Testing
Hands-on testing of encryption, authentication and segregation, plus rogue-device detection where required.
- 4
Reporting
An executive summary and technical report with findings, CVSS ratings and remediation advice.
- 5
Debrief
A walkthrough with your team covering the findings, the risk and the fixes.
- 6
Retest
Once remediated, we retest and reissue the report showing findings closed.
Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for wireless penetration testing?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Rogue wireless detection documented by a QSA company, so it stands as PCI DSS 11.2 evidence.
- On-site testing that covers configuration, authentication, segregation and signal leakage.
- Pairs with internal network testing to show the full impact of a wireless foothold.
- Fixed scope and price, with any retest and its window agreed in your proposal.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Does this satisfy PCI DSS Requirement 11.2?
Requirement 11.2 requires you to detect and identify unauthorised wireless access points. Our rogue wireless detection addresses this, and as a QSA company we document the work so it serves as evidence for your assessment.
Is wireless penetration testing legal?
Yes, when the owner of the network authorises it in writing. Testing or connecting to a wireless network you do not own without permission can be an offence under the Computer Misuse Act 1990, so we agree the sites, networks and limits in writing first and test only the networks named in scope. Our guide to whether penetration testing is legal in the UK covers the authorisation in more detail.
Does testing need to happen on site?
Yes. Wireless testing requires physical presence to survey the environment, test access points and detect rogue devices. We agree the sites and scheduling during scoping.
Can you test our guest Wi-Fi separation?
Yes. We test whether guest networks are properly isolated from corporate and internal systems, which is a common weakness and important where the cardholder data environment is in play.
What do you need from us for a wireless penetration test?
Access to the sites in scope, details of the wireless networks, and any credentials needed to test authenticated networks. For rogue detection we agree the areas to survey. We confirm the detail during scoping.
Will testing disrupt our wireless network?
We plan around your operations and avoid techniques that would disrupt live networks. Rules of engagement are agreed in advance and anything critical is escalated immediately.
How often should wireless testing be done?
At least annually, and after significant changes to your wireless environment. For PCI, rogue wireless detection should be performed at least quarterly, which we can schedule alongside your other testing.
Do you test WPA3 and enterprise (802.1X) Wi-Fi?
Yes. We test WPA2 and WPA3 networks, including transition modes that can let a client be downgraded, and enterprise networks using 802.1X, where weak certificate validation on clients is a common way to capture credentials.
How much does wireless penetration testing cost?
The main drivers are the number of sites and buildings, the number of wireless networks, and whether quarterly rogue access point checks for PCI are included. Our penetration testing cost guide covers the drivers, and our wireless penetration testing quote form gets you a fixed price.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- Internal Penetration TestingInternal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote.
- Network & infrastructure testingNetwork penetration testing for UK firms: external perimeter, internal network and Active Directory attack paths, plus PCI DSS segmentation tests. Get a quote.
- Cyber security ManchesterCyber security in Manchester and the North West from an Accrington-based PCI QSA and Cyber Essentials body: pen testing, CE+, PCI DSS and ISO 27001. Get a quote.
- PCI DSS penetration testingPCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Further reading
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]