Wireless Penetration Testing: Why WPA3 Alone Isn’t Enough

Wireless penetration testing exists to answer one question a strong password can’t: can someone who is simply within range of your building get onto your network anyway? Many businesses assume that switching to WPA3, or picking a long passphrase, closes that question for good. It doesn’t. A wireless penetration test is a controlled attempt by a tester to break into your Wi-Fi the way a real attacker would. It routinely finds gaps that a policy document never surfaces.

The assumption that gets businesses into trouble

“We use WPA3, so we’re covered” is one of the most common things a tester hears before a wireless engagement starts. It’s also one of the fastest assumptions to unravel. WPA3 replaced WPA2’s password exchange with a stronger method called Simultaneous Authentication of Equals. It does resist the offline dictionary cracking that made WPA2 passphrases so easy to break. But researchers Mathy Vanhoef and Eyal Ronen published the Dragonblood findings.

They showed that WPA3’s transition mode, the setting that lets WPA2 and WPA3 devices share a network for compatibility, can be abused. An attacker can push a client onto the weaker handshake and crack it from there. Transition mode is common precisely because most businesses run a mix of older and newer devices. That means the “we upgraded” answer is often untested rather than untrue. It’s one of several wireless security myths that hold up fine in conversation but not under test conditions.

What does wireless penetration testing actually check?

A dedicated WiFi penetration testing service scopes around exactly this problem. Coverage typically includes every access point in the building and the encryption protocols in use. It also covers the devices that connect to them, from staff laptops to tills and smart TVs. Testers look at how the wireless network is segmented from everything else too. A guest network that quietly shares a VLAN with finance systems undoes most of the value of a strong passphrase anyway.

Rogue access point testing is where the myth of “a good password is enough” falls apart fastest. A tester broadcasts a fake network with your real SSID and waits to see whether staff devices connect to it automatically. If they do, credentials and traffic are captured without a single password being cracked. No amount of passphrase strength stops that. The attack never touches your actual network at all.

How the test is carried out

The process follows the technical testing approach set out in the US National Institute of Standards and Technology’s SP 800-115 guide. It lists wireless scanning and assessment among its core methods. A tester scopes the sites and SSIDs, then maps access points and their broadcast range. From there they attempt handshake capture, rogue access points and de-authentication checks, all within agreed rules. Findings are verified and ranked by real risk rather than technical severity alone, so the report tells you what to fix first, not just what was found.

Older networks add another layer worth remembering. The KRACK vulnerability, disclosed in 2017, let an attacker within range manipulate the WPA2 handshake to read traffic that should have been encrypted. The National Cyber Security Centre’s guidance on it still stands. Patch access points and client devices. Don’t let Wi-Fi encryption be the only thing standing between an attacker and sensitive data.

None of this is exotic equipment. A tester’s kit is often a laptop, a compatible wireless adapter and open-source software that anyone with the right knowledge can download. That is exactly why the test matters: if the tools are that accessible, assuming nobody nearby has them is a bet, not a control.

Why “we’ve never had an issue” isn’t evidence either

Wireless attacks are quiet by design. A rogue access point doesn’t trigger a helpdesk ticket. A cracked handshake doesn’t show up in a firewall log. That’s part of why the PCI Security Standards Council requires businesses handling card data to test for unauthorised access points at least quarterly, under requirement 11.2. It’s also why Cyber Essentials Plus and ISO 27001 assessments both expect wireless in scope wherever it touches business systems. For businesses working through card payment compliance specifically, a full PCI DSS penetration testing engagement covers more ground than the quarterly rogue access point check alone. The absence of a visible incident is not the same as the absence of a working attack path.

How often is enough?

An annual penetration test is a sound baseline for most businesses. Repeat it after a new site opens or access points change. Anyone in scope for PCI DSS needs the extra quarterly rogue access point checks as well. Multi-site businesses are better served by staggering tests across locations than rushing through all of them at once.

What a test won’t tell you without the right scope

No single engagement covers everything by default, and that’s a scoping choice, not a shortcut. Bluetooth beacons, IoT sensors and smart building controls sit on separate radios from Wi-Fi and need to be named in scope if you want them tested. The same goes for social engineering angles, like leaving a rogue device plugged into a meeting room socket. None of this makes a standard wireless test less useful. It just means the assumption to challenge isn’t only “is our Wi-Fi secure.” It’s “did we actually ask someone to check the parts we’re relying on.”

The same logic applies to how many sites get tested. A business with five branches that only tests its head office has tested one assumption, not five. Attackers don’t care which building has the weakest access point configuration; they only need to find it. A scope that names every site is worth more than a report that reads well but quietly covers less than the business assumed.

Frequently asked questions

If we already use WPA3 everywhere, do we still need testing?

Yes, particularly if any devices fall back to WPA2 through transition mode, which most mixed-device networks use whether IT realises it or not.

Can an attacker get in without knowing our password at all?

Yes. Rogue access point attacks rely on a device connecting to a convincing fake network, not on guessing or cracking the real one.

Will testing interrupt staff during the working day?

A properly scoped test avoids sustained disruption and schedules anything with a higher chance of affecting users, such as de-authentication checks, outside busy periods.

Does the test include Bluetooth or IoT devices?

Only when it’s scoped to. Standard wireless testing focuses on Wi-Fi, though Bluetooth and IoT devices can be added where a business depends on them.

How do we know the test actually checked what we asked for?

A good report names the exact sites, SSIDs and dates tested, not just the techniques used. If that detail is missing, ask for it before treating the result as evidence of anything.

A strong encryption standard is a good starting point, not a finished job. Wireless penetration testing is what turns “we should be fine” into evidence. It’s usually cheaper to find these gaps in a controlled test than to find them out after someone else already has. The businesses that get the most from a test are the ones that treat the findings as a to-do list, not a certificate to file away.

If your last review of the office Wi-Fi was “we changed the password,” a scoped assessment is a reasonable next step. Aardwolf Security runs these engagements for UK businesses of various sizes; get in touch to talk through what one would look like for your sites.