1
Scope and authorize
We agree sites, networks and dates, and confirm which networks belong to you — neighbours are never in scope.
Network
Wireless network pentest
On-site testing of the wireless you run — corporate, guest, BYOD and device networks — including whether an attacker in the car park can capture credentials or land inside your corporate network.
8
areas covered
5
stages, scoping to retest
In-house
testers, never subcontracted
portal.cyberlysecure.com/acme-health/coverage
Acme Health — Test coverage4 practices · 16 services · one team
In-houseWeb app
API
SaaS
Mobile
Client-side
External
Internal
Segment test
Wireless
Vuln. assessment
Cloud config
Hardware & IoT
AI & LLM
Social eng.
Physical
Red team
ApplicationsNetworkCloud & devicesPeople & premises
6 in scope · one team · one report
In-house testers 0 subcontracted
Every surface one team
What this is
What the test covers.
Wireless extends your network past your walls. An attacker does not need to get through reception; they need to be within range, and with enterprise Wi-Fi the prize is often a domain credential rather than just internet access.
We test each network you broadcast, at each site in scope, and we check that the separation between them is real.
PTES NIST SP 800-115 OWASP Wireless testing guidance
What we test
- WPA2 and WPA3 configuration, personal and enterprise
- Enterprise authentication: EAP method, certificate validation and client configuration
- Evil-twin and rogue access point attacks against real client behaviour
- Handshake and PMKID capture, and passphrase strength
- Guest network isolation and client-to-client separation
- BYOD, printer, camera and IoT networks
- Signal reach beyond your premises
- Access point and controller management interfaces
How it runs
From scoping call to retest, here’s what happens.
Typically two to four days per site, confirmed at scoping.
2
Survey on site
We map what is broadcasting, from inside and from the perimeter, including anything broadcasting that you did not deploy.
3
Test each network
Each network is tested on its own terms — passphrase strength, client trust behaviour, isolation and management access.
4
Follow it inward
Where wireless access leads to internal access, we show how far it reaches.
5
Report, readout and retest
Findings are reported per site, with a readout and a retest once configuration changes land.
What it surfaces
The kind of thing this test tends to find.
Real examples of what this engagement uncovers — anonymized, and never every time. What matters is that you find out before somebody else does.
Client devices that hand over credentials to an access point presenting any certificate
Guest networks that can reach printers, cameras or internal ranges
Pre-shared keys that survive an offline cracking attempt in hours
Access point management reachable from the user network with default credentials
Old or forgotten SSIDs still broadcasting with weak configuration
Frameworks this test supports
Testing that counts toward your framework.
These programs call for this test, or their assessors and your customers expect it. If one of them is on your desk, readiness and testing come from the same team.
PCI DSS
Requirement 11.2 calls for finding and identifying every wireless access point, authorized or not, and wireless that touches the cardholder data environment has its own configuration rules; a wireless test shows whether a rogue or weak network gives a way in.
PCI DSS readinessCMMC
Level 2 requires you to authorize wireless access and protect it with authentication and encryption (AC.L2-3.1.16 and 3.1.17); a wireless test shows whether those controls hold in practice.
CMMC readinessHIPAA
Clinical, staff and guest Wi-Fi often run beside systems that hold ePHI; a wireless test shows whether the technical safeguards you rely on actually keep them apart.
HIPAA readiness Getting started
What you get, and what we need from you.
What you get
- Technical report — Every finding, the evidence behind it and clear guidance your engineers can act on.
- Executive summary — Your risk explained in plain language for leadership and the board.
- Attestation letter — Signed confirmation of testing to hand your auditors.
- Readout call — A walkthrough with the people who tested your systems.
- Retest — Confirmation your fixes worked, documented for whoever needs to see it.
What we need from you
- Site addresses, dates and on-site contacts
- The list of SSIDs that belong to you
- Permission from the building owner where you do not own the site
- Escort arrangements if any area needs one
Missing something on this list? Bring it to the call — we scope around what you have.
Others in Network
Network
External network pentest
See everything you expose to the internet the way an attacker sees it.
Read moreNetwork
Internal network pentest
Know what an attacker could reach once they’re inside your network.
Read moreNetwork
Network segmentation test
Prove your sensitive environments are truly isolated.
Read moreNetwork
Vulnerability assessment
Know every weakness across your estate, confirmed by a person and ranked by the risk it really carries.
Read more