Wireless Penetration Testing Guide: Scope and Govern

Radio does not stop at the property line, so a wireless penetration test touches airspace, devices and people the client does not own and cannot authorise testing against. That makes wireless testing different from almost every other kind of assessment: the law on interception and interference applies regardless of the client's permission, neighbouring organisations and the public share the spectrum, and a poorly scoped rogue access point exercise can disrupt the very users it is meant to protect. This guide is for security managers, network owners and procurement teams who commission and govern wireless tests covering Wi-Fi, Bluetooth and other short-range radio. It covers scope, provider rules and qualifications, legal limits, rogue access point and wireless intrusion detection scope, contracts and authorisation, and findings handling. It does not describe testing techniques. For configuration guidance, see the Wi-Fi Security Guide.

Key takeaways

Client consent is not lawful authority. Laws such as the UK Wireless Telegraphy Act 2006 and the US Communications Act restrict interception and interference whoever asks for the test; jamming is prohibited for private businesses in the US with no exemption.
Scope by networks and devices you own, not by area. Write the scope as named SSIDs, BSSIDs, controllers and device classes, and require that anything else seen in the air is recorded passively and left alone.
Rogue AP work needs its own rules. Locating unauthorised access points is high value and low risk; impersonating your networks or containing devices can affect neighbours and staff and needs explicit, separate approval.
Test the monitoring as well as the network. Agree in advance whether the wireless intrusion detection or prevention system and the SOC are told, and measure what they detected.
Treat captured data as personal data. Wireless surveys record device identifiers and may capture traffic from staff, visitors and the public; minimise, protect and delete it on agreed terms.

What a wireless test should answer

NIST SP 800-115 describes wireless scanning in passive and active modes and stresses that testers must take care near public areas and avoid neighbouring organisations' and visitors' devices, favouring locating rogue devices over probing them. A commissioned test should be built around questions the organisation needs answered, then constrained by those limits.

Question	Typical scope element	Relative risk to others
Are there unauthorised access points or bridges on our wired network?	Rogue AP discovery and location across all sites	Low: largely passive
Do our corporate SSIDs meet our configuration standard?	Configuration and authentication review of named SSIDs	Low
Would staff devices connect to a network impersonating ours?	Client-side exposure of enterprise Wi-Fi settings	Medium: can attract neighbours' and visitors' devices
Is guest Wi-Fi properly separated from internal networks?	Guest and partner SSIDs, captive portal, isolation	Low to medium
Can a device on wireless reach systems it should not?	Post-association segmentation review	Low if limited to owned networks
Are Bluetooth, RFID and other radio devices exposed?	Named device classes such as badges, scanners, IoT sensors	Low to medium depending on proximity to public
Would our WIDS/WIPS and SOC notice?	Detection validation with agreed notification rules	Low

When to commission one: after deploying or replacing a wireless platform, before and after migrating to WPA3 or certificate-based authentication, when opening a new site or moving into shared premises, after a rogue device or suspicious wireless incident, and on whatever recurring cycle compliance obligations set. Between tests, continuous WIDS monitoring and management platform reports should carry the load, with the test confirming they work. For how a wireless test fits a broader programme, see the Penetration Testing Guide.

Legal limits: interception and interference

This is where wireless testing differs most from network testing. A signed authorisation covers the client's own systems; it cannot authorise conduct that the law prohibits outright, nor give permission on behalf of third parties.

Jurisdiction	Provision	What it means for a commissioned test
United Kingdom	Wireless Telegraphy Act 2006, s48	Offence to use wireless telegraphy apparatus with intent to obtain the contents, sender or addressee of a message one is not an intended recipient of, without lawful authority, and to disclose such information. Keep content capture to the client's own networks and minimise it.
United Kingdom	Wireless Telegraphy Act 2006, s68	Offence to use apparatus for the purpose of interfering with wireless telegraphy; up to two years' imprisonment on indictment. Deliberate interference is out of scope.
United States	Communications Act s302(b) (47 U.S.C. 302a(b)), 47 C.F.R. 2.803, s333	The FCC states operating a jammer is prohibited and that there are no exemptions for use within a business; s333 prohibits wilful or malicious interference with authorised radio communications. Penalties under ss501, 503 and 510 include fines, forfeiture and equipment seizure.
Interception in general	National interception and computer misuse laws	Rules vary by country and can apply to traffic from devices the client does not own. Get legal advice for each jurisdiction where testing happens.

No jamming, no broad disruption: state in the rules of engagement that jamming and any activity intended to deny service to others is excluded.
Disruption of your own users: any activity that could disconnect clients from the organisation's own networks needs explicit approval, a time window and a named owner, because nearby networks and devices may share channels and be affected too.
Multi-country estates: if the test covers sites in several countries, the provider confirms the legal position in each, and the client's counsel signs off.

Neighbouring networks, public areas and shared buildings

Only owned identifiers are targets: SP 800-115 notes that rogue identification can use MAC address vendor prefixes, an authorised device list (which can be spoofed), unauthorised SSIDs and signal strength for location. The scope should list authorised SSIDs, BSSIDs and controller names so testers can tell which networks are yours.
Record, do not engage: networks and devices that are not clearly owned are logged as observations and never connected to or interacted with.
Shared and leased premises: in multi-tenant buildings, landlords or managed building networks may own access points in your space. Confirm ownership and get the landlord's written permission or exclude them.
Public areas: work from car parks, streets or lobbies that the client does not control needs consideration of the public, local rules and site security, and testers should carry the authorisation letter and a client contact number.
Client-side exposure tests: these can attract devices belonging to visitors and neighbours. Limit them in time, location and to the client's own SSID names, and require that unowned devices are not engaged.

Rogue access point and WIDS scope

NIST SP 800-153 covers WLAN security configuration and continuous monitoring, and SP 800-94 treats wireless intrusion detection and prevention as its own class. Many organisations also face recurring rogue wireless testing requirements, such as PCI DSS for cardholder data environments. Decide what the test should prove about these controls before the provider arrives.

Activity	Value	Governance needed
Rogue AP discovery and location	Finds unmanaged access points and wired bridges	Standard authorisation; list of authorised devices
Review of WIDS/WIPS configuration and alerts	Shows whether rogue and impersonation alerts fire and reach the SOC	Access to the WIDS console or exported alerts
Impersonation of corporate SSIDs (evil twin, ATT&CK T1557.004)	Shows whether client settings and detection hold	Separate written approval, time window, own SSIDs only, no capture of unowned devices' credentials
Testing automated containment	Confirms WIPS containment acts only on the right targets	High caution: containment features can affect neighbours' networks; legal review and vendor guidance first
Planted device scenario	NCSC lists an unauthorised device connected to the internal network as a test scenario	Physical access approval, coordination with site security

Notified or unannounced: an unannounced test measures real detection but risks a security response against testers. A common middle ground is to brief a small trusted group, keep the SOC uninformed, and give the test lead a verification phrase for site security. See the Social Engineering and Physical Penetration Testing Guide where physical access is involved.

Scoping the radio estate

Use the Penetration Test Scoping Checklist for the general items. Wireless-specific inputs to provide:

Sites and floors: addresses, floor plans and the areas testers may access, including any restricted areas needing escort.
Networks: each SSID with purpose (corporate, guest, IoT, voice, OT), security mode (for example WPA2-Enterprise, WPA3-Personal, WPA3 transition mode, Enhanced Open), authentication method (EAP-TLS, PEAP-MSCHAPv2) and the controller or cloud management platform.
Authorised devices: access point inventory with BSSIDs and vendor, so rogues can be distinguished.
Other radio: Bluetooth and Bluetooth Low Energy devices, RFID and badge systems, warehouse scanners, wireless OT and IoT links. Name what is in scope; NIST SP 800-121 Rev. 2 and SP 800-98 give the security baselines for Bluetooth and RFID respectively.
Test accounts and devices: whether the provider gets a corporate-build laptop, a test certificate or guest credentials, so authenticated-user scenarios do not require attacking real staff.
Windows and contacts: test hours, a network operations contact who can disable a misbehaving access point or stop activity, and the escalation route.

Small versus large estates: a single office may need one day covering corporate and guest Wi-Fi plus a rogue sweep. A retail or logistics estate should test a representative sample of site types, verify central policy in the management platform, and rely on continuous WIDS monitoring between tests rather than repeating full site visits.

Choosing and qualifying a provider

Commercial evaluation is covered in the Penetration Testing Provider Buyer's Guide. Wireless-specific requirements:

Legal awareness: the provider explains in writing how its methodology stays within interception and interference law in each jurisdiction, and which activities it will not perform.
Named, experienced testers: CVs showing wireless assessments in comparable environments, including enterprise 802.1X, WPA3 and the management platform you use.
Scheme membership where required: UK public sector and critical national infrastructure buyers can use NCSC CHECK assured companies; NCSC guidance stresses suitable qualifications and experience for any tester.
Data handling: how captures are encrypted, stored, retained and destroyed, and how unowned devices' identifiers are filtered from deliverables.
Equipment and identification: testers carry the authorisation letter and photo identification, and equipment is logged in and out of site.

Contracts and authorisation

Authorisation letter: signed by someone with authority over the networks and premises, listing sites, dates, times, SSIDs and BSSIDs, permitted activities and named testers.
Explicit exclusions: jamming, interaction with unowned networks and devices, and any activity at locations not listed.
Separate approvals: client-side impersonation, containment testing and planted-device scenarios each need their own approval line.
Third parties: landlords, managed Wi-Fi providers and cloud management vendors may need to consent or be notified; some managed service contracts restrict testing.
Liability and stop rights: the client and provider can each halt testing immediately; agree liability for disruption to the client's own users.

Where identity fits

Wireless findings are frequently identity findings. A shared pre-shared key is a single credential held by every user and device, and it rarely rotates when people leave; IoT devices often join with the same key. Microsoft documents that PEAP-MSCHAPv2 is exposed to credential attacks similar to NTLMv1 and that clients should validate the RADIUS server through configured server names and trusted root certificates, while EAP-TLS uses certificates and is the only method for WPA3-Enterprise 192-bit mode. Ask the provider to report on credential exposure, then manage device certificates and keys as machine identities. See the IoT Security Guide.

Findings, data handling and measurement

Minimise captures: only the client's own traffic, only what the objective needs. Filter identifiers of unowned devices out of reports, or hash them.
Protect deliverables: reports and captures can contain credentials and network keys. Use encrypted transfer, restricted distribution and agreed deletion dates for the provider's copies.
Rotate exposed secrets: any pre-shared key, certificate or account exposed during testing is rotated after the test, as are test credentials.
Own the risk rating: NCSC notes the organisation owns risk decisions and tester ratings are an input.
Metrics: rogue access points found per site and time to remove them; percentage of corporate SSIDs meeting the configuration standard; share of findings detected by WIDS or the SOC during the test; remaining SSIDs on shared keys or legacy authentication; median time to remediate wireless findings; repeat findings from the previous test.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	CA-8, CA-8(1)	Penetration testing, independent test team
NIST SP 800-53 Rev. 5	AC-18, AC-18(1), SC-40, SI-4(14), CM-8	Wireless access, authentication and encryption, wireless link protection, wireless intrusion detection, inventory
NIST CSF 2.0	ID.RA-01, ID.IM-02, GV.SC-05	Vulnerabilities identified, improvements from tests, supplier contract requirements
CIS Controls v8.1	Control 18	Penetration testing programme
ISO/IEC 27001:2022	A.8.8, A.8.34	Technical vulnerability management, protection of systems during audit testing
ATT&CK v20	T1557.004, T1040	Evil twin and network sniffing: what detection should catch

Common failure patterns

Scope by building, not by network: the provider is told to "test the Wi-Fi at head office" and engages a neighbour's access point. Scope by owned identifiers.
Disruption without approval: activity that disconnects clients knocks out handheld scanners or voice handsets mid-shift. Treat any disruptive activity as a separately approved, time-boxed item.
Containment left on auto: a WIPS containment feature acts on a neighbouring network during or after the test. Review containment policy legally before testing it.
Only Wi-Fi tested: badges, Bluetooth peripherals and wireless OT links are never in scope, so the riskiest radio is never assessed.
Captures kept forever: raw captures with credentials and third-party identifiers sit in a provider's archive. Contract for deletion and get confirmation.
Shared keys survive the report: the test shows a PSK is widely known, but it is not rotated because devices would need reconfiguring. Plan the migration to per-device credentials as part of remediation.

Practitioner checklist

List every in-scope SSID, BSSID, controller and radio device class; everything else is observe-only.
Exclude jamming and any interaction with unowned networks or devices in the rules of engagement.
Get legal sign-off for each jurisdiction, covering interception and interference law.
Require separate written approval for impersonation, containment and planted-device scenarios.
Obtain landlord or managed-service consent for any access points you do not own.
Decide whether WIDS and the SOC are told, and record what they detected.
Provide test accounts or a test device so authenticated scenarios do not target real staff.
Contract for minimal capture, encrypted handling and confirmed deletion of provider data.
Rotate every key, certificate and credential exposed during testing.
Track rogue AP removal time and migration away from shared keys as programme metrics.

Wireless Penetration Testing Guide: Scoping and Testing Wi-Fi and Radio Networks