What is wireless penetration testing?
Wireless penetration testing is an authorised assessment of the Wi-Fi an organisation runs: the access points broadcasting in its buildings, the network names they advertise, the encryption and authentication they use, and what any of that would give an attacker who is close enough to listen. Wireless is the one part of the estate that leaves the building on its own, reaching the car park, the floor above and the street outside, so it is worth testing from where an attacker would actually stand.
PentestOps runs it from two vantage points at the same time. It reads the inventory your wireless controller already keeps, and it listens over the air from a deployed agent that reports only what is genuinely in range of its radio. The two views are compared, and the assessment follows the same PTES-aligned seven-phase methodology and the same per-tenant Rules of Engagement as every other engagement on the platform.
| Question | Short answer |
|---|---|
| What it tests | Access points, network names, and the encryption and authentication your Wi-Fi is configured to use. |
| Where it looks from | The controller's own records, and the air, through a radio in range. |
| Attacker position | Close enough to hear the network, without a valid credential yet. |
| What stays fixed | Nobody is disconnected by default, and no look-alike network is ever stood up. |
| What you get | Findings attributed to their source, graded on the shared catalogue, with drift tracked between surveys. |
Assessed from two directions at once
A wireless controller knows what it was told to broadcast. It cannot tell you what is actually reaching the pavement, or what someone stood up without asking. A survey from the air knows what is on the air, but not the intent behind it. Neither view is complete on its own, so PentestOps takes both and reads them together.
The first view is the inventory from your wireless controller: every access point, every network name, and the encryption and authentication configuration recorded for each. The second is a passive over-the-air survey from a deployed agent that listens on its own radio and reports what is genuinely in range. It listens; it does not announce itself, and it does not touch a device to build this picture.
Because the two views can disagree, every finding is attributed to its source. A finding from the management plane and a finding from the air are labelled as such, so you can tell a configuration your controller admits to from a signal that is present in the building whatever the records say. The gaps between the two, a network the controller lists that nothing heard, or a signal in range that the controller never mentioned, are often the most useful part of the result.
Graded against one catalogue, tracked for drift
Wireless does not get its own private scoring. A weak wireless network is graded against the same catalogue the rest of the platform uses, so it lands in the same remediation queue, with the same severity language, as a weak service on the wire or a misconfiguration in the cloud. Your team reads one queue, not a separate wireless report written in a dialect of its own.
Wireless also changes quietly. An access point is swapped, a guest network is reconfigured, a temporary network for an event is left running. So each survey is compared with the last. A network moved to weaker encryption is raised as a change. An access point that appeared without a change request is raised as a change. Drift is reported as drift, next to the posture grade, so a slow slide toward a weaker configuration is visible before it becomes the way things have always been.
The first active test asks the access point directly
When active testing is authorised, the quietest test runs first. It approaches a single access point by its own hardware address and asks for the key material that access point offers to anyone starting to connect. It takes that and nothing else. It transmits only at the one radio it was authorised to touch, and it disconnects no one to do it.
What is recovered is then tested for one thing: whether it would fall to a determined attacker. A passphrase that would not survive that kind of sustained effort is a finding worth acting on. A passphrase that holds is reported as one that held. The test measures resistance; it does not stage a break-in, and it does not need to interrupt anyone to reach its answer.
An advanced test, off by default
One test is stronger, and it is opt-in. It can briefly interrupt the devices on one named network to measure how quickly a passphrase would fall under real pressure. That is a genuinely more invasive thing to do, so the platform treats it that way. It is off by default and it stays off until each of these has happened in order:
- The quieter tests have run first and found nothing. The invasive test is offered only after the direct, non-disruptive test has been tried and has not produced an answer.
- The cost is shown before it is authorised. The operator sees plainly what the test does, including the brief interruption to devices on the one named network, before agreeing to it.
- Only the one named radio is touched. The test acts on a single named network and nothing adjacent to it.
- The authorisation for that radio is recorded before dispatch. The signed authorisation for that specific radio exists in the record before the test is ever sent to the agent, not after.
Two boundaries that always hold
Two limits are not options, profiles or defaults you can drift past. They hold on every wireless engagement:
- Nobody is disconnected by default. The only test that interrupts devices is the opt-in one above, and it interrupts only the one named network it was authorised for. Everything else leaves users connected.
- The assessment never impersonates one of your networks. It does not stand up a look-alike network to lure devices or harvest sign-in details. Testing the real network is in scope; pretending to be it, to catch your own people, is not.
What you need to run it
Wireless testing needs a radio in the building, because you cannot survey the air from a data centre. A single agent on a host with a Wi-Fi radio is enough to begin, and the requirements grow only when you move from listening to active work.
One point is worth stating plainly: putting a frame on the air cannot be withdrawn once done. That is why active testing is authorised per access point and per hardware address, rather than once for the whole site. The authorisation names the exact radio the test may touch.
| Requirement | Why it is needed |
|---|---|
| An agent host with a Wi-Fi radio | A single radio is enough for the passive over-the-air survey. |
| A spare radio for active work | Any inexpensive USB adapter that supports monitor mode. The agent's own uplink radio cannot be borrowed mid-assessment. |
| Authorisation per access point | Signed per access point and per hardware address, because a frame on the air cannot be recalled. |
Honest reporting, including what we could not establish
The most useful wireless report is the one that admits its own edges. Where an answer could not be established, the report says so plainly, rather than rounding it up to a clean result.
Two habits in particular keep the report honest. A network we heard nothing from is not a network we have cleared; it is a network the survey did not reach, and it is reported that way, not as an absence of risk. And a passphrase that did not fall is reported as exactly that: a passphrase that did not fall in this test. It is never dressed up as proof the network is secure, because a test that did not break something is not the same as a guarantee it cannot be broken.
Where wireless testing fits
Wireless is one lane of a single platform. Once an attacker is associated to your Wi-Fi they are on the inside, which is exactly where internal network penetration testing picks up, enumerating hosts, accounts and trust relationships and validating how far a foothold could spread. Your internet-facing exposure is covered separately by external network penetration testing, and running wireless on a continuous penetration testing cadence is what makes drift between surveys visible in the first place.
PentestOps is an Australian-built platform from Extranet Systems Pty Ltd, an ISO/IEC 27001:2022 certified company, hosted in Australia with customer data stored in Australia. Findings map to 8 compliance reporting frameworks plus CIS Benchmarks, exportable as PDF, CSV or JSON/API. Pricing is asset-wise: scans against the assets in scope are unlimited within fair use. See pricing to get started.