An attacker doesn’t need to be inside to be on your network.

No. A configuration review checks whether your controller and access-point settings match a standard or vendor best practice. A wireless pentest proves what an attacker actually achieves over the air: standing up an Evil Twin, capturing a domain login because a device does not verify the server certificate, or reaching an internal system from the guest network. A clean configuration and an exploitable network can coexist, which is why regulated multi-site estates run both, the review on the controller release cycle and the pentest against sites and segmentation.

An Evil Twin is a fake copy of a trusted Wi-Fi network, stood up by an attacker to trick devices into connecting to it instead of the real one. When a staff device connects, if it does not properly verify it is talking to the genuine Wi-Fi login server, it can hand over the user’s credentials. It is one of the most common and damaging wireless attacks because it needs no access to your network, only proximity, and we test your resistance to it directly.

Yes, at least in part, and that is by design. Wi-Fi is a radio medium, so an attacker has to be within range and so do we; a genuine wireless test means a specialist physically present at your site, with proper equipment across the 2.4, 5 and 6 GHz bands. Some preparation and reporting happen remotely, but the testing itself is on-site. For estates with many locations we agree a representative sample of sites during scoping rather than visiting every one, which keeps the engagement proportionate.

No, not without your consent. We work under documented Rules of Engagement, agreed windows and no-impact criteria, and our default posture is passive listening plus targeted, controlled tests rather than anything that floods the spectrum or disrupts users. Techniques that could affect availability are only used with prior approval and your team informed. We test on your real network without taking it down.

A single site typically takes a few days of on-site testing plus scoping and the retest; multiple sites, or a complex controller and segmentation setup, run one to two weeks. Travel and site access shape the schedule, so we plan it with you. We confirm the timeline in the proposal, delivered within 48 hours of the first call.

Price follows the number of sites, the number of SSIDs and the complexity of your authentication and segmentation. We quote a fixed price with no hidden fees and no obligation to renew. A single-site assessment sits at the bottom of the range; multi-site estates scale from there, with travel agreed up front. The retest that confirms your fixes is always included.

Grey box fits most engagements: you tell us your SSIDs and segmentation design, so we spend the time testing rather than discovering the basics. Black box mirrors a stranger in the car park with no prior knowledge, best for an honest exposure baseline. White box adds controller and RADIUS configuration for the deepest review. We work out which one fits you on the introductory meeting.

The senior specialist you meet on the first call runs it on-site, end to end. Our team holds OSCP, OSCE³, OSWE and OSEP credentials, works by hand with proper wireless equipment across 2.4, 5 and 6 GHz, and we are NASA Bug Bounty verified contributors. The same person scopes, executes and retests. That person is your point of contact throughout.