Corporate Wi-Fi is often protected less carefully than the VPN, even though it gives anyone in radio range, including an attacker sitting in the building next door, a path onto the internal network. This page ranks the ten wireless network security risks we see most often in enterprise and branch networks, each with what goes wrong, how to detect it and the fix. It draws on primary sources: the Wi-Fi Alliance's WPA3 requirements, NIST SP 800-153 Guidelines for Securing Wireless Local Area Networks, the KRACK, FragAttacks and Dragonblood research disclosures, CERT/CC's WPS advisory and Volexity's 2024 report on the "Nearest Neighbor Attack". It is for network and security engineers, and for leaders deciding where wireless spending goes. For the full design guidance read the Wi-Fi Security Guide; this page is the list of what usually goes wrong. The ranking is our editorial judgement of impact and frequency.
The Top 10 at a glance
| # | Risk | What an attacker gains | First fix |
|---|---|---|---|
| 1 | Corporate Wi-Fi that accepts a username and password alone | Network access from anywhere in radio range with sprayed or phished credentials | Certificate-based EAP-TLS for managed devices |
| 2 | Wi-Fi and guest networks not segmented from sensitive systems | A foothold on Wi-Fi becomes a foothold on the core | Treat Wi-Fi as an untrusted access network, like VPN |
| 3 | Shared pre-shared keys that are weak or never rotated | Offline cracking, access by former staff and contractors | Move staff to 802.1X; long unique keys or per-device keys elsewhere |
| 4 | Clients that do not validate the RADIUS server certificate | Evil twin captures enterprise credentials | Push a managed Wi-Fi profile with server name and CA pinned |
| 5 | Rogue and evil twin access points | Interception of users and an unmanaged bridge into the LAN | Wireless intrusion detection plus switch-port controls |
| 6 | Legacy protocols and WPA3 transition mode left on indefinitely | Downgrade to weaker handshakes | Retire WEP, WPA and TKIP; plan an end date for transition mode |
| 7 | Unpatched access points, controllers and client drivers | Exploitation of protocol and implementation flaws | Firmware and driver patching with an inventory |
| 8 | WPS PIN left enabled | Brute force of the PIN and recovery of the network key | Disable WPS on every access point and router |
| 9 | Management frames left unprotected | Forced disconnection that sets up an evil twin | Require Protected Management Frames (802.11w) |
| 10 | Staff on untrusted Wi-Fi and unmanaged Bluetooth | Interception and device attack outside the office | Always-on VPN, autoconnect off, Bluetooth discipline |
Items 1 to 4 are about who can join the network and how far a foothold reaches; items 5 to 9 are about rogue hardware, old protocols and unpatched kit an attacker in radio range can exploit; item 10 covers staff once they leave the office.
1. Corporate Wi-Fi that accepts a username and password alone
What goes wrong: enterprise Wi-Fi uses 802.1X with a password-based method such as PEAP-MSCHAPv2, so a valid domain username and password is all that is needed to join. MFA protects the VPN and email but not the radio network. In the case Volexity named the Nearest Neighbor Attack, an actor it attributes to APT28 obtained valid credentials by password spraying an internet-facing service; MFA stopped them using those credentials there, but the target's Wi-Fi required only a domain username and password. The attacker was thousands of miles away, so they compromised a dual-homed system in a nearby organisation and joined the target's Wi-Fi from it. MITRE ATT&CK now tracks this as Wi-Fi Networks (T1669).
How to detect it: check the EAP methods your RADIUS or NAC policy accepts. If any password-based method is allowed for the corporate SSID, the risk is present. Look for Wi-Fi authentications from accounts that also show failed logins on internet-facing services, and for successful joins at hours when the site is closed.
The fix: move managed devices to EAP-TLS with device certificates from your MDM or PKI, and remove password-based methods from the corporate SSID. Volexity's recommendations are to strengthen Wi-Fi authentication with MFA or certificate-based access and treat corporate Wi-Fi with the same rigour as VPN access. See the 802.1X and EAP-TLS Enterprise Wi-Fi Guide.
2. Wi-Fi and guest networks not segmented from sensitive systems
What goes wrong: the corporate SSID lands users on the same flat network as servers and domain controllers, and the guest network can reach internal ranges through a forgotten route or a shared VLAN. After Organization A in the Volexity case remediated, the attacker came back through a system on its guest Wi-Fi network that could still reach the corporate network.
How to detect it: from a test device on each SSID, try to reach internal subnets, management interfaces and domain controllers. Review firewall rules between wireless VLANs and the core for "any" rules.
The fix: put each SSID in its own VLAN or VRF behind a firewall; give the guest network internet access only, with client isolation; allow corporate Wi-Fi only the services users need. Volexity recommends separating Wi-Fi and wired networks, especially where wired networks reach sensitive resources. See the Network Access Control (NAC) Guide and the Zero Trust Network Segmentation Playbook for Flat Networks.
3. Shared pre-shared keys that are weak or never rotated
What goes wrong: a single WPA2-Personal passphrase is used for years, printed on the wall of the meeting room and known to every former employee and contractor. A WPA2-PSK handshake captured over the air can be attacked offline, which ATT&CK covers as Password Cracking (T1110.002), so a short or guessable passphrase gives way without any further contact with the network. Changing it means touching every device, so it never happens.
How to detect it: list SSIDs that use a PSK, the date each key was last changed and who knows it. Any PSK on a network that reaches internal resources is a finding.
The fix: keep PSKs only for networks that cannot use 802.1X, such as some IoT devices, and isolate those networks. Use WPA3-Personal, which the Wi-Fi Alliance says gives increased protection from password guessing attempts, a long random passphrase, and per-device or per-group keys where your platform supports them. Rotate on staff and contractor departures.
4. Clients that do not validate the RADIUS server certificate
What goes wrong: users join the corporate SSID by hand, accept whatever certificate prompt appears, or the profile does not pin the server name and issuing CA. An evil twin advertising the same SSID with its own RADIUS server then receives the user's credentials, which is exactly what makes risk 1 so dangerous.
How to detect it: inspect deployed Wi-Fi profiles in your MDM or Group Policy for server certificate validation, trusted root CA and allowed server names. Any device that joined manually is suspect.
The fix: deploy Wi-Fi profiles only through management tooling, with server validation enforced, the trusted root CA pinned and expected server names listed. Do not let users override the prompt. With EAP-TLS this also removes the password from the exchange altogether.
5. Rogue and evil twin access points
What goes wrong: an employee plugs a consumer access point into a desk port, creating an unmanaged bridge into the LAN, or an attacker broadcasts an SSID that matches yours or one your users have saved. ATT&CK describes Evil Twin (T1557.004): fake access points that use the SSID of a legitimate network, a stronger signal, or replies to devices' probe requests for previously joined networks. Plugging in unauthorised hardware maps to Hardware Additions (T1200).
How to detect it: wireless intrusion detection that compares observed BSSIDs and SSIDs against your authorised list, alerts on your SSID broadcast by unknown radios, and correlates unknown radios with wired MAC addresses seen on your switches. NIST SP 800-53 Rev. 5 SI-4(14) calls for a wireless intrusion detection system to identify rogue devices and detect attacks. See the Wireless intrusion detection guide.
The fix: 802.1X or NAC on wired ports so a rogue access point cannot get network access, WIDS alerting with a response runbook, and periodic site surveys. When a rogue is found, follow the Rogue Device on Network Playbook.
6. Legacy protocols and WPA3 transition mode left on indefinitely
What goes wrong: WEP, WPA with TKIP, or mixed WPA/WPA2 modes stay enabled for one old scanner or handheld, and WPA3 is deployed in transition mode (WPA2 and WPA3 together) with no end date. The Dragonblood research, disclosed in 2019, showed that an attacker can force WPA3-capable clients onto a rogue WPA2-only network in transition mode and then attack the password offline. The Wi-Fi Alliance states that WPA3 networks disallow outdated legacy protocols and that WPA3 is mandatory for Wi-Fi CERTIFIED devices.
How to detect it: export SSID security settings from every controller and cloud dashboard. Flag WEP, TKIP, WPA (version 1) and any transition-mode SSID, with the devices that still depend on it.
The fix: disable WEP and TKIP everywhere now. Use WPA3-only SSIDs for devices that support it, with a separate isolated legacy SSID and a retirement date for its devices, rather than transition mode on the main network. The Dragonblood authors still recommend moving to WPA3 with vendor patches applied.
7. Unpatched access points, controllers and client drivers
What goes wrong: access point firmware and client Wi-Fi drivers are rarely in the patch programme. Several Wi-Fi flaws sit in the standard itself. KRACK, disclosed in 2017 by Mathy Vanhoef of KU Leuven, forced nonce reuse in WPA and WPA2, personal and enterprise; its authors stress that both clients and access points must be patched, and that changing the Wi-Fi password does not help. FragAttacks, disclosed in May 2021, included three design flaws affecting most devices including WPA3, and every one of more than 75 tested devices was affected by at least one vulnerability; enabling 802.11w or EAP-TLS does not mitigate them.
How to detect it: keep an inventory of access point, controller and client chipset firmware versions, and compare it with vendor advisories. Check the CISA Known Exploited Vulnerabilities Catalog for your wireless controller and access point products.
The fix: bring wireless infrastructure and endpoint drivers into the vulnerability management programme with the same service levels as other network devices, and replace hardware that no longer receives updates. See the Firmware and Boot Security Guide.
8. WPS PIN left enabled
What goes wrong: Wi-Fi Protected Setup remains on, often by default, on small office and branch routers. CERT/CC advisory VU#723755 (CVE-2011-5053) explains that the design of WPS PIN authentication lets an attacker learn whether the first half of the 8-digit PIN is correct, and the last digit is a checksum, cutting the attempts needed from about 108 to roughly 11,000. An attacker in range can recover the network password or change the access point configuration. CERT/CC knew of no practical fix and recommends disabling WPS.
How to detect it: scan beacons at each site for WPS information elements, and audit router configurations at branches and home offices.
The fix: disable WPS on every device, confirm by scan that it is really off, and prefer enterprise-managed access points at branch sites.
9. Management frames left unprotected
What goes wrong: without Protected Management Frames, anyone can forge deauthentication frames to knock clients off the network, either as denial of service or to push them towards an evil twin and capture a fresh handshake. The Wi-Fi Alliance states that PMF extends protection to unicast and multicast management action frames, that WPA3 networks must require PMF and that PMF is required for all new certified devices.
How to detect it: review SSID settings for PMF set to "required" rather than "optional" or "disabled"; WIDS alerts on deauthentication floods show active abuse.
The fix: require PMF on WPA3 SSIDs, set it to at least optional on WPA2 SSIDs while legacy clients remain, and move towards required. Remember that jamming at the radio layer is not stopped by PMF; see the Physical Layer and Wireless Jamming Guide.
10. Staff on untrusted Wi-Fi and unmanaged Bluetooth
What goes wrong: laptops and phones autoconnect to saved open networks in hotels, cafés and airports, and Bluetooth is left discoverable. The NSA's Cybersecurity Information Sheet Securing Wireless Devices in Public Settings (July 2021) recommends avoiding public Wi-Fi where possible, using a VPN, turning off autoconnect and forgetting networks after use, disabling Bluetooth when it is not in use, not leaving devices in discovery mode and rejecting pairing requests you did not start.
How to detect it: check endpoint policy for always-on VPN, saved open networks and Bluetooth discoverability across the fleet.
The fix: enforce always-on VPN or a zero trust access client on managed laptops, remove saved open networks by policy, and set Bluetooth defaults through MDM. See the Public Wi-Fi Safety Guide and the Bluetooth, RFID and NFC Security Guide.
Where identity fits
Most of the top risks are identity failures on the radio network. A password-only Wi-Fi login is a human credential with no second factor; a shared PSK is a credential with no owner; IoT devices on a PSK network are non-human identities with no lifecycle. Certificate-based device identity (NIST SP 800-53 Rev. 5 IA-3, Device Identification and Authentication) solves risks 1, 3 and 4 together, provided certificates are issued by your MDM or PKI, revoked when devices leave and monitored for expiry. Treat RADIUS shared secrets and controller API keys as privileged secrets, with an owner and rotation.
Measuring wireless security
| Metric | How to collect | Target |
|---|---|---|
| Share of corporate Wi-Fi authentications using EAP-TLS | RADIUS or NAC logs by EAP method | Close to 100% for managed devices |
| SSIDs with WEP, TKIP, WPS or indefinite transition mode | Controller configuration export and site scans | Zero, or each with a dated exception |
| Access points on supported, current firmware | Controller inventory against vendor advisories | 100% within your patch window |
| Rogue access point alerts and time to remove | WIDS alerts and ticket timestamps | Every alert triaged; removal within one business day |
| Wireless segments that can reach restricted subnets | Quarterly reachability tests from each SSID | Zero unapproved paths |
Mapping to frameworks
| Risk | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|
| 1, 3, 4 Authentication | AC-18(1), IA-3 | PR.AA-03 | T1669, T1110.002 |
| 2 Segmentation | AC-18, SC-7 | PR.IR-01 | T1669 |
| 5 Rogue and evil twin | SI-4(14) | DE.CM-01 | T1557.004, T1200 |
| 6, 8, 9 Protocol settings | AC-18(1), SC-40, CM-7 | PR.IR-01 | T1040 |
| 7 Patching | SI-2 | ID.RA-01 | |
| 10 Untrusted networks | AC-18(3), SC-8 | PR.AA-03 | T1557.004 |
NIST SP 800-153 consolidates NIST's WLAN configuration and monitoring recommendations. In ISO/IEC 27001:2022, Annex A controls A.8.20 networks security and A.8.22 segregation of networks apply. For authorised testing of these risks, see the Wireless Penetration Testing Guide.
Where to start
- Check whether corporate Wi-Fi accepts password-only logins and plan the move to EAP-TLS (risk 1).
- Test reachability from every SSID, guest first, and close paths to the core (risk 2).
- Run a configuration export and site scan for WEP, TKIP, WPS, PMF and transition mode (risks 6, 8 and 9).
- Bring access point firmware and client Wi-Fi drivers into patch reporting (risk 7).
- Then switch on WIDS alerting with a rogue device runbook and enforce Wi-Fi profiles and VPN by MDM (risks 4, 5 and 10).
Practitioner checklist
- Corporate SSIDs accept EAP-TLS only for managed devices; password-based EAP methods are removed.
- Wi-Fi profiles are pushed by MDM or Group Policy with server validation, CA and server names pinned.
- Every SSID sits in its own segment; guest is internet only with client isolation.
- No WEP, TKIP or WPA (version 1) anywhere; transition mode has an end date.
- WPS is disabled and verified by scan at every site, including branches.
- PMF is required on WPA3 SSIDs and enabled on WPA2 SSIDs.
- Access point, controller and client driver firmware is inventoried and patched to policy.
- WIDS alerts on rogue and spoofed SSIDs feed the SOC with a response runbook.
- Remaining PSKs are long, random, owned and rotated on departures.
- Laptops use always-on VPN, saved open networks are removed and Bluetooth defaults are set by policy.
Standards and references
- Wi-Fi Alliance: Wi-Fi CERTIFIED WPA3 and Wi-Fi Security
- NIST: SP 800-153, Guidelines for Securing Wireless Local Area Networks
- CERT/CC: VU#723755, WiFi Protected Setup PIN brute force vulnerability
- KU Leuven research: Key Reinstallation Attacks (KRACK)
- Mathy Vanhoef: FragAttacks, fragmentation and aggregation attacks
- Mathy Vanhoef and Eyal Ronen: Dragonblood, analysing WPA3's Dragonfly handshake
- NSA: Securing Wireless Devices in Public Settings
- Volexity: The Nearest Neighbor Attack
Related NHI Mgmt Group resources: Wi-Fi Security Guide · 802.1X and EAP-TLS Enterprise Wi-Fi Guide · Wireless intrusion detection · Securing Your Wi-Fi Network Guide